In Windows environments that are already protected by appropriate security controls, Microsoft Defender Antivirus scanning can sometimes consume significant CPU and disk I/O resources. This can affect SQL Server, DataSelf ETL+, and other data-intensive workloads.
Before disabling or broadly excluding Defender scanning, consider the following approaches, starting with the least intrusive.
1. Identify whether Defender is causing the performance issue
Before making exclusions, confirm that Microsoft Defender is consuming significant CPU or disk resources during SQL Server or DataSelf workloads.
Windows Task Manager, Resource Monitor, Performance Monitor, and Microsoft Defender performance-analysis tools can help identify excessive scanning activity.
2. Add targeted Microsoft Defender exclusions
Where appropriate, organizations can exclude specific SQL Server, DataSelf, and auxiliary processes or folders from real-time scanning.
Security warning: Defender exclusions reduce malware protection for the excluded resources. Review all exclusions with your IT/security team and use the narrowest exclusions practical for your environment. Avoid excluding entire drives or large application folders unless specifically required.
Run PowerShell using an account with Windows administrator privileges.
Review and adjust all paths and processes below before running these commands:
# Windows Defender Whitelisting via PowerShell
Extensions that are usually safe
Add-MpPreference -ExclusionExtension ".mdf"
Add-MpPreference -ExclusionExtension ".ndf"
Add-MpPreference -ExclusionExtension ".ldf"
Add-MpPreference -ExclusionExtension ".bak"
Add-MpPreference -ExclusionExtension ".trn"
# SQL Data/log/tempdb folders
Add-MpPreference -ExclusionPath "C:\Program Files\Microsoft SQL Server\MSSQL15.MSSQLSERVER\MSSQL"
Add-MpPreference -ExclusionPath "C:\Program Files\Microsoft SQL Server\MSSQL15.MSSQLSERVER\MSSQL\Data"
Add-MpPreference -ExclusionPath "C:\Program Files\Microsoft SQL Server\MSSQL15.MSSQLSERVER\MSSQL\Log"
Add-MpPreference -ExclusionPath "C:\Program Files\Microsoft SQL Server\MSSQL15.MSSQLSERVER\MSSQL\TempDB"
Add-MpPreference -ExclusionPath "C:\Program Files\Microsoft SQL Server\MSSQL15.MSSQLSERVER\MSSQL\Backup"
# SQL Server processes
Add-MpPreference -ExclusionProcess "sqlservr.exe"
Add-MpPreference -ExclusionProcess "sqlagent.exe"
Add-MpPreference -ExclusionProcess "fdlauncher.exe"
Add-MpPreference -ExclusionProcess "msmdsrv.exe"
# Auxiliary apps
Add-MpPreference -ExclusionProcess "ssms.exe"
Add-MpPreference -ExclusionProcess "Taskmgr.exe"
# DataSelf apps and folders
Add-MpPreference -ExclusionProcess "DataSelf ETL Plus.exe"
Add-MpPreference -ExclusionProcess "DataSelfWindowsService.exe"
# Add-MpPreference -ExclusionExtension "txt" *** Review
# Add-MpPreference -ExclusionPath "C:\Users\Public\DataSelf Corp" *** Review
Generally, process and specific-folder exclusions are preferable to broad file-extension exclusions. If your security policy permits extension exclusions, SQL Server database and transaction-log files may also be considered:
Add-MpPreference -ExclusionExtension ".mdf"
Add-MpPreference -ExclusionExtension ".ndf"
Add-MpPreference -ExclusionExtension ".ldf"
Be especially cautious about excluding backup extensions such as .bak and .trn, because backup files may be copied from or to other systems.
3. Review existing exclusions
Use PowerShell to review the current Microsoft Defender configuration:
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess
Get-MpPreference | Select-Object -ExpandProperty ExclusionExtension
Individual exclusions can be removed later:
Remove-MpPreference -ExclusionProcess "YourApp.exe"
Remove-MpPreference -ExclusionPath "C:\Path\To\YourFolder"
Remove-MpPreference -ExclusionExtension ".ext"
4. Limit Defender CPU usage during scheduled scans
Windows Defender provides settings that can limit how much CPU scheduled scans are allowed to consume. This can be useful when scans must run on a production server but should not consume excessive processing capacity.
For example:
Set-MpPreference -ScanAvgCPULoadFactor 20
The appropriate value depends on the server workload and the organization's security requirements.
5. Use centralized security policies
In managed environments, Defender settings may be controlled centrally through tools such as:
-
Microsoft Intune
-
Microsoft Defender for Endpoint
-
Group Policy
-
Microsoft Configuration Manager
In these environments, exclusions and performance settings should generally be implemented through the organization's centralized security policy rather than manually on individual servers.
6. Disabling Defender scanning
Completely disabling Microsoft Defender Antivirus or real-time protection provides the largest reduction in Defender-related resource consumption, but it also significantly reduces the server's security protection.
This should generally be considered only when another approved endpoint-protection solution is providing equivalent protection, or when the organization's IT/security team has explicitly approved the configuration.
DataSelf does not recommend disabling endpoint protection solely as a performance optimization.