You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/troubleshoot-performance-issues.md
+15-15Lines changed: 15 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -90,7 +90,7 @@ Process Monitor (ProcMon) is an advanced monitoring tool that can show real-time
90
90
91
91
1. Select **Apply**.
92
92
93
-
:::image type="content" source="media/procmon-motw.png" alt-text="Screenshot showing the Remove MOTW page" lightbox="media/procmon-motw.png":::
93
+
:::image type="content" source="media/procmon-motw.png" alt-text="Screenshot showing the Remove MOTW page." lightbox="media/procmon-motw.png":::
94
94
95
95
3. Unzip the file in `C:\temp` so that the folder path is `C:\temp\ProcessMonitor`.
96
96
@@ -104,11 +104,11 @@ Process Monitor (ProcMon) is an advanced monitoring tool that can show real-time
104
104
105
105
Since logging starts automatically, select the magnifying glass icon to stop the current capture or use the keyboard shortcut **Ctrl+E**.
106
106
107
-
:::image type="content" source="media/procmon-magglass.png" alt-text="Screenshot showing the magnifying glass icon" lightbox="media/procmon-magglass.png":::
107
+
:::image type="content" source="media/procmon-magglass.png" alt-text="Screenshot showing the magnifying glass icon." lightbox="media/procmon-magglass.png":::
108
108
109
109
To verify that you've stopped the capture, check if the magnifying glass icon now appears with a red X.
110
110
111
-
:::image type="content" source="media/procmon-magglass-stop.png" alt-text="Screenshot showing a red slash" lightbox="media/procmon-magglass-stop.png":::
111
+
:::image type="content" source="media/procmon-magglass-stop.png" alt-text="Screenshot showing a red slash." lightbox="media/procmon-magglass-stop.png":::
112
112
113
113
Next, to clear the earlier capture, select the eraser icon.
114
114
@@ -118,7 +118,7 @@ Process Monitor (ProcMon) is an advanced monitoring tool that can show real-time
118
118
119
119
2. The second way is to run the **command line** as admin, then from the Process Monitor path, run:
120
120
121
-
:::image type="content" source="media/cmd-procmon.png" alt-text="Screenshot showing the cmd procmon" lightbox="media/cmd-procmon.png":::
121
+
:::image type="content" source="media/cmd-procmon.png" alt-text="Screenshot showing the cmd procmon." lightbox="media/cmd-procmon.png":::
122
122
123
123
```console
124
124
Procmon.exe /AcceptEula /Noconnect /Profiling
@@ -127,11 +127,11 @@ Process Monitor (ProcMon) is an advanced monitoring tool that can show real-time
127
127
> [!TIP]
128
128
> Make the ProcMon window as small as possible when capturing data so you can easily start and stop the trace.
129
129
>
130
-
> :::image type="content" source="media/procmon-minimize.png" alt-text="Screenshot showing the page with Procmon minimized" lightbox="media/procmon-minimize.png":::
130
+
> :::image type="content" source="media/procmon-minimize.png" alt-text="Screenshot showing the page with Procmon minimized." lightbox="media/procmon-minimize.png":::
131
131
132
132
7. After following one of the procedures in step 6, you'll next see an option to set filters. Select **OK**. You can always filter the results after the capture is completed.
133
133
134
-
:::image type="content" source="media/procmon-filter-options.png" alt-text="Screenshot showing the page where System Exclude is chosen as the Filter out Process Name" lightbox="media/procmon-filter-options.png":::
134
+
:::image type="content" source="media/procmon-filter-options.png" alt-text="Screenshot showing the page where System Exclude is chosen as the Filter out Process Name." lightbox="media/procmon-filter-options.png":::
135
135
136
136
8. To start the capture, select the magnifying glass icon again.
137
137
@@ -182,7 +182,7 @@ Alternatively, you can also use the command-line tool *wpr.exe*, which is availa
182
182
183
183
3. When the User Account Control dialog box appears, select **Yes**.
184
184
185
-
:::image type="content" source="media/wpt-yes.png" alt-text="Screenshot showing the UAC page" lightbox="media/wpt-yes.png":::
185
+
:::image type="content" source="media/wpt-yes.png" alt-text="Screenshot showing the UAC page." lightbox="media/wpt-yes.png":::
186
186
187
187
4. Next, download the [Microsoft Defender for Endpoint analysis](https://github.com/YongRhee-MDE/Scripts/blob/master/MDAV.wprp) profile and save as `MDAV.wprp` to a folder like `C:\temp`.
188
188
@@ -194,7 +194,7 @@ Alternatively, you can also use the command-line tool *wpr.exe*, which is availa
194
194
195
195
7. After that, you should see a new profile set under *Custom measurements* named *Microsoft Defender for Endpoint analysis* underneath it.
196
196
197
-
:::image type="content" source="media/wpr-infile.png" alt-text="Screenshot showing the in-file" lightbox="media/wpr-infile.png":::
197
+
:::image type="content" source="media/wpr-infile.png" alt-text="Screenshot showing the in-file." lightbox="media/wpr-infile.png":::
198
198
199
199
> [!WARNING]
200
200
> If your Windows Server has 64 GB of RAM or more, use the custom measurement `Microsoft Defender for Endpoint analysis for large servers` instead of `Microsoft Defender for Endpoint analysis`. Otherwise, your system could consume a high amount of non-paged pool memory or buffers which can lead to system instability. You can choose which profiles to add by expanding **Resource Analysis**.
@@ -217,14 +217,14 @@ Alternatively, you can also use the command-line tool *wpr.exe*, which is availa
217
217
218
218
9. Now you're ready to collect data. Exit all the applications that aren't relevant to reproducing the performance issue. You can select **Hide options** to keep the space occupied by the WPR window small.
219
219
220
-
:::image type="content" source="media/wpr-08.png" alt-text="Screenshot showing the Hide options" lightbox="media/wpr-08.png":::
220
+
:::image type="content" source="media/wpr-08.png" alt-text="Screenshot showing the Hide options." lightbox="media/wpr-08.png":::
221
221
222
222
> [!TIP]
223
223
> Try starting the trace at whole number seconds. For instance, 01:30:00. This will make it easier to analyze the data. Also try to keep track of the timestamp of exactly when the issue is reproduced.
224
224
225
225
10. Select **Start**.
226
226
227
-
:::image type="content" source="media/wpr-09.png" alt-text="Screenshot showing the Record system information page" lightbox="media/wpr-09.png":::
227
+
:::image type="content" source="media/wpr-09.png" alt-text="Screenshot showing the Record system information page." lightbox="media/wpr-09.png":::
228
228
229
229
11. Reproduce the issue.
230
230
@@ -233,27 +233,27 @@ Alternatively, you can also use the command-line tool *wpr.exe*, which is availa
233
233
234
234
12. Select **Save**.
235
235
236
-
:::image type="content" source="media/wpr-10.png" alt-text="Screenshot showing the Save option" lightbox="media/wpr-10.png":::
236
+
:::image type="content" source="media/wpr-10.png" alt-text="Screenshot showing the Save option." lightbox="media/wpr-10.png":::
237
237
238
238
13. Fill up **Type in a detailed description of the problem:** with information about the problem and how you reproduced the issue.
239
239
240
-
:::image type="content" source="media/wpr-12.png" alt-text="Screenshot showing the pane in which you fill" lightbox="media/wpr-12.png":::
240
+
:::image type="content" source="media/wpr-12.png" alt-text="Screenshot showing the pane in which you fill." lightbox="media/wpr-12.png":::
241
241
242
242
1. Select **File Name:** to determine where your trace file is saved. By default, it's saved to `%user%\Documents\WPR Files\`.
243
243
244
244
1. Select **Save**.
245
245
246
246
14. Wait while the trace is being merged.
247
247
248
-
:::image type="content" source="media/wpr-13.png" alt-text="Screenshot showing the WPR gathering general trace" lightbox="media/wpr-13.png":::
248
+
:::image type="content" source="media/wpr-13.png" alt-text="Screenshot showing the WPR gathering general trace." lightbox="media/wpr-13.png":::
249
249
250
250
15. Once the trace is saved, select **Open folder**.
251
251
252
-
:::image type="content" source="media/wpr-14.png" alt-text="Screenshot that displays the notification that WPR trace has been saved" lightbox="media/wpr-14.png":::
252
+
:::image type="content" source="media/wpr-14.png" alt-text="Screenshot that displays the notification that WPR trace has been saved." lightbox="media/wpr-14.png":::
253
253
254
254
Include both the file and the folder in your submission to Microsoft Support.
255
255
256
-
:::image type="content" source="media/wpr-15.png" alt-text="Screenshot showing the details of the file and the folder" lightbox="media/wpr-15.png":::
256
+
:::image type="content" source="media/wpr-15.png" alt-text="Screenshot showing the details of the file and the folder." lightbox="media/wpr-15.png":::
0 commit comments