Antivirus Tuning (CrowdStrike & Windows Defender) Hello All ! Is anyone use CrowdStrike or Windows Defender as EDR / Antivirus solution ? I am looking for tips to reduce performance impact of those products. I observe a huge performance impact with Crowdstrike. I have already apply Citrix AV recommendation. If you have any other tips, I am interested Thanks

We have always been told by our AV team and others that crowdstrike doesnt need the typical standard AV exclusions for files/folders ect. There is a VDI=1 switch when installing crowdstrike falcon sensor and you have to delete the Crowdstrike Agent ID reg key during sealing and set some grouping tags but thats all i have had to do

You don't need AV if Crowdstrile is installed. It's like having two AV working at the same time. Which has a huge impact on the performances as both are acting like the other one is a virus (no matter what the vendors say "they are compatible"). Just put Windows Defender in passive mode (installed but inactive, can be called for a regular analysis if you need). A part from that, even in CrowdStrike, put in place the exception list. VDI=1 switch is here to say "MultiSession and Ephemeral environment"

yup the crowdstrike documentation even says to turn windows defender off (We got it turned off via gpo)