Guys, I have a new Windows 11 non persistent (FSLogix, 2402CU1) build and MS Defender is smashing the CPU during logon and takes around 10mins to settle. All of the exclusions look good and IVe even tried disabling via GPO but its still doing some amount of damage. Anyone see this behavior before on recent versions? cheers

I haven't dealt with Defender since my last job, but we used to see similar in our non-persistent W10 build, though it was manageable. How are you handling sealing Defender in the master?

Nice one, Nick. Much appreciated. I'll have a look 🙂

Any time. If I didn't do that scan in the master, I'd see similar behavior. CPU was just hammered. I don't think you can eliminate it entirely - we sure as hell didn't - but these settings seemed to help for us.

Cool. Theres also print spooler noise. This biz use wem for a LOAD of print maps and I can see theres lots of missing drivers on the new image which the client was working on. Ahh the joys!

I haven't used anything other than Citrix Universal Print driver in like a decade, lol

I wrote an article and some scripts on offloading Defender, and included my GPO settings for optimization. Offloading is great, because you can update definitions multiple times in the day and Defender just switches to them on the fly. https://www.jeffriechers.com/wiki/vdi-defender-offloading/ Also make sure to do the scan on sealing so that any files that havent changed don't get scanned again. C:\Program Files\Microsoft Security Client\mpcmdrun.exe - SignatureUpdateAndQuickScan

Magic - thanks, Jeff 🙂

FWIW, I had to bake the defs location and settings into the master, otherwise it would not grab the GPO settings.

I have to seal (update def and full scan) our vDisk every 14 days otherwise perf become bad.

Thanks folks, getting back into this since the holiday break. From what I read disabling via GPO no longer works on Win11 for security reasons. I will test with the def/sig share and sealing process to see how we go. I don't think Id have such and issue with a multisession setup as once it settles its fine but the non persistent single session VDAs are a different story 😞

Last day I had to re-seal our W16 vDisk for the def update and full + quick scan as we have a script installing our business apps at boot time and some apps have a timeout and it was flagging in our monitoring tool as it was too slow to install. Rolled out the vDisk and all back to normal.

Folks, I tried Cisco AMP AV as a test, it has the same behavior as Defender where it smashes the CPU for 5 mins or so and slows logons. This somewhat settles down on the 2nd logon, I've disabled the default restart on logoff and have enabled autologon to prime the VDAs which has helped a bit (Thanks @James Rankin, blog used!). I've been through AV exclusions a handful of times and don't see anything wrong but I have just found that bypassing/disabling FSLogix the CPU issue goes away. I'm going to triple check the process, path and file exclusions relating to it and we will see how we go. I've never had these issues with Defender and FSLogix in the past doing a load of deployments, but to note, this is the first time Iven used it with Win11 on a single session/VDI setup so I could be missing a trick. If a user logs into a certain VDI for the 2nd time (with FSLogix enabled) with no reboot, I don't see the issue, cheers

Here are the exclusions we ran at my last place, in case it helps: Extension Exclusions:

DAT
ICA
IDX
LOG
OST
PF
POL
TMP
VHDX

Path Exclusions:

%ProgramFiles%\FSLogix\Apps\frxccd.sys
%ProgramFiles%\FSLogix\Apps\frxdrv.sys
%ProgramFiles%\FSLogix\Apps\frxdrvvt.sys
%TEMP%\*.VHDX
%WinDir%\security\database\*.chk
%WinDir%\security\database\*.edb
%WinDir%\security\database\*.jrs
%WinDir%\security\database\*.log
%WinDir%\security\database\*.sdb
%WinDir%\system32\drivers\BNIStack6.sys
%WinDir%\system32\drivers\BNNF.sys
%WinDir%\system32\drivers\BNPort.sys
%WinDir%\System32\drivers\CFsDep2.sys
%WinDir%\System32\drivers\CNicTeam.sys
%WinDir%\System32\drivers\CtxUvi.sys
%WinDir%\System32\drivers\CVhdBusP6.sys
%WinDir%\System32\drivers\CVhdMp.sys
%WinDir%\system32\drivers\DNNS.sys
%WinDir%\TEMP\*.VHDX
C:\Users\*\AppData\Local\Temp\Citrix\HDXRTConnector\*\*.txt
D:\EventLogs
D:\FSLogix
D:\pagefile.sys
D:\vdiskdif.vhdx
D:\WEMCache
D:\WEMCacheBackup

Process Exclusions:

%ProgramFiles%\Citrix\ICAService\CpSvc.exe
%ProgramFiles%\Citrix\ICAService\CtxSvcHost.exe
%ProgramFiles%\Citrix\ICAService\picaSvc2.exe
%ProgramFiles%\Citrix\ICAService\WebSocketService.exe
%ProgramFiles%\Citrix\Provisioning Services\BNDevice.exe
%ProgramFiles%\Citrix\Provisioning Services\TargetOSOptimizer.exe
%ProgramFiles%\Citrix\User Profile Manager\UserProfileManager.exe
%ProgramFiles%\Citrix\Virtual Desktop Agent\BrokerAgent.exe
%ProgramFiles%\FSLogix\Apps\frxccds.exe
%ProgramFiles%\FSLogix\Apps\frxsvc.exe
%ProgramFiles%\Microsoft OneDrive\OneDrive.exe
%ProgramFiles(x86)%\Citrix\ICA Client\AuthManager\AuthManSvr.exe
%ProgramFiles(x86)%\Citrix\ICA Client\CDViewer.exe
%ProgramFiles(x86)%\Citrix\ICA Client\concentr.exe
%ProgramFiles(x86)%\Citrix\ICA Client\HdxRtcEngine.exe
%ProgramFiles(x86)%\Citrix\ICA Client\SelfServicePlugin\SelfService.exe
%ProgramFiles(x86)%\Citrix\ICA Client\SelfServicePlugin\SelfServicePlugin.exe
%ProgramFiles(x86)%\Citrix\ICA Client\wfica32.exe
%ProgramFiles(x86)%\Citrix\Workspace Environment Management Agent\AgentGroupPolicyUtility.exe
%ProgramFiles(x86)%\Citrix\Workspace Environment Management Agent\Citrix.Wem.Agent.LogonService.exe
%ProgramFiles(x86)%\Citrix\Workspace Environment Management Agent\Citrix.Wem.Agent.Service.exe
%ProgramFiles(x86)%\Citrix\Workspace Environment Management Agent\VUEMCmdAgent.exe
%ProgramFiles(x86)%\Citrix\Workspace Environment Management Agent\VUEMUIAgent.exe
%ProgramFiles(x86)%\Microsoft\Teams\current\Squirrel.exe
%ProgramFiles(x86)%\Microsoft\Teams\current\Teams.exe
%ProgramFiles(x86)%\Microsoft\Teams\Update.exe
%ProgramFiles(x86)%\Netskope\STAgent\stAgentSvc.exe
%ProgramFiles(x86)%\Netskope\STAgent\stAgentUI.exe
%WinDir%\System32\spoolsv.exe
%WinDir%\system32\userinit.exe
%WinDir%\system32\winlogon.exe

Thanks, Nick. I'll cross check em 🙂

"Agent Error" status due to CtxUvi in 2203 CU5 / CU6... Thoughts?