My 2019 RDS servers are getting killed with CPU lately. Looking right now, Windows Defender Advanced Threat Protection Service is hovering around 10%. I have typical things excluded like FSLogix, etc. Anything else you guys typically do? Trying to find a good way to "watch" what its scanning so I can look at adding exclusions. I cant imagine excluding word.exe or outlook.exe would be a good idea.

Check out what is being scan using https://learn.microsoft.com/en-us/defender-endpoint/tune-performance-defender-antivirus

i was trying that, but it was only showing me things for my user, not everyone else on the server

Weird it was showing it for all load, maybe you were generating the top one?

hmm all I entered was

New-MpPerformanceRecording -RecordTo c:\recording.etl

Hm it is defo working for me. Run it for a longer period with real users.

ill let it run for longer I guess

Ah, something crashing, you exclude this path also

I havent excluded that... most of it is stuff like outlook.exe or winword.exe, but isnt that dangerous to exclude?

Run it more and see what is triggering Defender. If things constantly crash or maybe you have a trace enabled, I would first try to understand what is causing it and then exclude it probably but that's your call

when I caught it earlier.. it looked like TiWorker/CBS logs were going nuts.. which is odd cause windows updates shouldnt have been happening mid day, and I see nothing in the "recently installed" updates. I'll watch closely. Thanks for the tips