You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/activity-filters-queries.md
+4-1Lines changed: 4 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,8 +20,11 @@ Below is a list of the activity filters that can be applied. Most filters suppor
20
20
- Activity objects – Search for the objects the activity was done on. This filter applies to files, folders, users, or app objects.
21
21
- Activity object ID - the ID of the object (file, folder, user, or app ID).
22
22
23
-
- Item - Enables you to search by the name or ID of any activity object (for example, user names, files, parameters, sites). For the **Activity object Item** filter, you can select whether to filter for items that **Contain**, **Equal**, or **Starts with** the specific item.
23
+
- Item - Enables you to search by the name or ID of any activity object (for example, user names, files, parameters, sites). For the **Activity object Item** filter, you can select whether to filter for items that **Contains**, **Equals**, or **Starts with** the specific item.
Copy file name to clipboardExpand all lines: defender-endpoint/troubleshoot-av-performance-issues-with-wprui.md
+67-23Lines changed: 67 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,6 +21,12 @@ ms.custom:
21
21
22
22
# Troubleshoot Microsoft Defender Antivirus performance issues with WPRUI
23
23
24
+
> [!TIP]
25
+
> First, review common reasons for performance issues such as high CPU usage in [Troubleshoot performance issues related to Microsoft Defender Antivirus real-time protection (RTP) or scans (scheduled or on-demand](/defender-endpoint/troubleshoot-performance-issues)).
26
+
> Then, run the [Microsoft Defender Antivirus Performance Analyzer](/defender-endpoint/tune-performance-defender-antivirus) to analyze the cause of high CPU usage in Microsoft Defender Antivirus (Antimalware Service Executable, Microsoft Defender Antivirus service, or MsMpEng.exe).
27
+
> If the Microsoft Defender Antivirus Performance Analyzer doesn't identify the root cause of high CPU utilization, run [Processor Monitor](/defender-endpoint/troubleshoot-av-performance-issues-with-procmon) to narrow down or determine the root cause of the high CPU utilization in Microsoft Defender Antivirus.
28
+
> The final tool in your toolkit is to run the Windows Performance Recorder UI (WPRUI) or the Windows Performance Recorder (WPR command-line) as discussed in this article.
29
+
24
30
## Capture performance logs using Windows Performance Recorder
25
31
26
32
Windows Performance Recorder (WPR) is a powerful recording tool that creates Event Tracing for Windows recordings and allows you to include additional information in your submission to Microsoft support.
@@ -29,62 +35,88 @@ WPR is part of the Windows Assessment and Deployment Kit (Windows ADK) and can b
29
35
30
36
Alternatively, follow the steps in [Capture performance logs using the WPR UI](/editor/MicrosoftDocs/defender-docs-pr/defender-endpoint%2Ftroubleshoot-performance-issues.md/main/ae28f1cf-14bc-fb9c-5f0c-873a683e907c/?branch=main&branchFallbackFrom=main%2C), or use the command-line tool *wpr.exe*[Capture performance logs using the WPR CLI](/editor/MicrosoftDocs/defender-docs-pr/defender-endpoint%2Ftroubleshoot-performance-issues.md/main/ae28f1cf-14bc-fb9c-5f0c-873a683e907c/?branch=main&branchFallbackFrom=main%2C). Both are available in Windows 8 and later versions.
31
37
38
+
There are two ways to capture the Windows Performance Recorder (WPRUI) trace:
39
+
40
+
1. Using the MDE Client Analyzer
41
+
42
+
1. Manually
43
+
44
+
## Using the MDE Client Analyzer
45
+
46
+
1. Download the [MDE Client Analyzer](/defender-endpoint/download-client-analyzer).
47
+
48
+
1. Run the MDE Client Analyzer using [Live Response or locally](/defender-endpoint/run-analyzer-windows).
49
+
50
+
> [!TIP]
51
+
> Before starting the trace, make sure the issue is reproducible. Additionally, close any applications that don't contribute to the reproduction of the issue.
52
+
53
+
54
+
1. Run the MDE Client Analyzer with the `-a` and `-v` switches.
> If multiple devices are experiencing this issue, try using the one with the most RAM.
67
+
> If multiple devices are experiencing this issue, use the one with the most RAM.
36
68
37
69
1. Download and install WPR.
38
70
39
71
1. Under *Windows Kits*, right-click **Windows Performance Recorder**.
40
72
41
73
42
-
74
+
43
75
1. Select **More**. Select **Run as administrator**.
44
76
45
77
1. Right-click **Yes** when the User Account Control dialog box appears.
46
78
47
79
48
-
80
+
49
81
1. Next, download the [Microsoft Defender for Endpoint analysis](https://github.com/YongRhee-MDE/Scripts/blob/master/MDAV.wprp) profile and save as `MDAV.wprp` to a folder such as `C:\temp`.
50
82
51
83
1. In the WPR dialog box, select **More options**.
52
84
53
85
54
-
86
+
55
87
1. Select **Add Profiles...** and browse to the path of the `MDAV.wprp` file.
56
88
57
89
1. A new profile named Microsoft Defender for Endpoint analysis should appear under Custom measurements.
58
90
59
91
60
-
92
+
61
93
> [!WARNING]
62
-
> If your Windows Server has 64 GB of RAM or more, use the custom measurement `Microsoft Defender for Endpoint analysis for large servers` instead of `Microsoft Defender for Endpoint analysis`. Otherwise, your system consumes a high amount of non-paged pool memory or buffers, leading to system instability. Explore**Resource Analysis** to choose profiles to add.
94
+
> If your Windows Server has 64 GB of RAM or more, use the custom measurement `Microsoft Defender for Endpoint analysis for large servers` instead of `Microsoft Defender for Endpoint analysis`. Otherwise, your system might consume a high amount of nonpaged pool memory or buffers, leading to system instability. To address this, explore**Resource Analysis** to choose profiles to add.
63
95
> This custom profile provides the necessary context for in-depth performance analysis.
64
96
65
97
1. To use the custom measurement Microsoft Defender for Endpoint verbose analysis profile in the WPR UI:
66
98
67
99
1. Ensure no profiles are selected under the *First-level triage*, *Resource Analysis* and *Scenario Analysis* groups.
68
100
69
-
2. Select **Custom measurements**.
101
+
1. Select **Custom measurements**.
70
102
71
-
3. Select **Microsoft Defender for Endpoint analysis**.
103
+
1. Select **Microsoft Defender for Endpoint analysis**.
72
104
73
-
4. Select **Verbose** under *Detail* level.
105
+
1. Select **Verbose** under *Detail* level.
74
106
75
-
5. Select **File** or **Memory** under Logging mode.
107
+
1. Select **File** or **Memory** under Logging mode.
76
108
77
109
> [!IMPORTANT]
78
-
> Select **File** to use the file logging mode if you can directly reproduce the performance issue. Most issues fall under this category. However, if you cannot directly reproduce the issue, select Memory to use the memory logging mode. This prevents the trace log from inflating excessively due to long run times.
110
+
> Select **File** to use the file logging mode if you can directly reproduce the performance issue. Most issues fall under this category. However, if you can't directly reproduce the issue, select **Memory** to use the memory logging mode. This prevents the trace log from inflating excessively due to long run times.
79
111
80
-
1. Now you're ready to collect data. Close all unnecessary applications. Click**Hide options** to keep the space occupied by the WPR window small.
112
+
1. Now you're ready to collect data. Close all unnecessary applications. Select**Hide options** to keep the space occupied by the WPR window small.
81
113
82
114
83
-
115
+
84
116
1. Select **Start**.
85
117
86
118
87
-
119
+
88
120
1. Reproduce the issue.
89
121
90
122
> [!TIP]
@@ -93,25 +125,25 @@ Alternatively, follow the steps in [Capture performance logs using the WPR UI](/
93
125
1. Select **Save**.
94
126
95
127
96
-
128
+
97
129
1. Fill in **Type in a detailed description of the problem:** with information about the problem and how you reproduced the issue.
98
130
99
131
100
-
132
+
101
133
1. Select **File Name:** to determine where your trace file is saved. By default, it's saved to `%user%\Documents\WPR Files\`.
102
134
103
-
1. Select **Save**.
135
+
1. Select **Save**.
104
136
105
137
106
-
138
+
107
139
1. After the trace has been merged and saved, right-click **Open folder**.
108
140
109
141
110
-
111
-
Include both the file and the folder in your submission to Microsoft Support.
142
+
143
+
1. Include both the file and the folder in your submission to Microsoft Support.
112
144
113
145
114
-
146
+
115
147
### Capture performance logs using the WPR CLI
116
148
117
149
To collect a WPR trace using the command-line tool wpr.exe:
@@ -131,7 +163,7 @@ To collect a WPR trace using the command-line tool wpr.exe:
131
163
```
132
164
133
165
> [!WARNING]
134
-
> If your Windows Server has 64 GB of RAM or more, use profiles `WDForLargeServers.Light` and `WDForLargeServers.Verbose` instead of profiles `WD.Light` and `WD.Verbose`, respectively. Otherwise, your system consumes a high amount of non-paged pool memory or buffers, leading to system instability.
166
+
> If your Windows Server has 64 GB of RAM or more, use profiles `WDForLargeServers.Light` and `WDForLargeServers.Verbose` instead of profiles `WD.Light` and `WD.Verbose`, respectively. Otherwise, your system consumes a high amount of nonpaged pool memory or buffers, leading to system instability.
135
167
136
168
1. Reproduce the issue.
137
169
@@ -150,8 +182,20 @@ To collect a WPR trace using the command-line tool wpr.exe:
150
182
151
183
## See also
152
184
185
+
-[Run the client analyzer on Windows](/defender-endpoint/run-analyzer-windows)
186
+
153
187
-[Collect Microsoft Defender Antivirus diagnostic data](collect-diagnostic-data.md)
188
+
189
+
-[Troubleshoot Microsoft Defender Antivirus settings](/defender-endpoint/troubleshoot-settings)
190
+
154
191
-[Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md)
192
+
193
+
-[Troubleshoot performance issues related to Microsoft Defender Antivirus](/defender-endpoint/troubleshoot-performance-issues)
194
+
155
195
-[Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md)
156
196
157
-
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]
197
+
-[Troubleshoot Microsoft Defender Antivirus performance issues with Process Monitor](/defender-endpoint/troubleshoot-av-performance-issues-with-procmon)
198
+
199
+
-[Troubleshoot Microsoft Defender Antivirus performance issues with WPRUI](/defender-endpoint/troubleshoot-av-performance-issues-with-wprui)
200
+
201
+
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]
-[Microsoft Defender for Cloud Apps](/defender-cloud-apps/what-is-defender-for-cloud-apps)
33
34
34
35
In Microsoft Defender XDR Unified role-based access control (RBAC), you can edit and delete custom roles or roles that were imported from Defender for Endpoint, Defender for Identity, or Defender for Office 365.
35
36
@@ -39,7 +40,7 @@ The following steps guide you on how to edit roles in Microsoft Defender XDR Uni
39
40
40
41
> [!IMPORTANT]
41
42
> You must be a Global Administrator or Security Administrator in Microsoft Entra ID, or have all the Authorization permissions assigned in Microsoft Defender XDR Unified RBAC to perform this task. For more information on permissions, see [Permission pre-requisites](manage-rbac.md#permissions-prerequisites).
42
-
> Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
43
+
> Microsoft recommends that you use roles with the fewest permissions to help improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
43
44
44
45
1. Sign in to the [Microsoft Defender portal](https://security.microsoft.com) as global administrator or security administrator.
45
46
@@ -49,7 +50,7 @@ The following steps guide you on how to edit roles in Microsoft Defender XDR Uni
49
50
50
51
4. Select the role you want to edit. You can only edit one role at a time.
51
52
52
-
5. Once selected, this opens a flyout pane where you can edit the role:
53
+
5. Once selected, a flyout pane opens where you can edit the role:
53
54
54
55
:::image type="content" source="/defender/media/defender/m365-defender-rbac-edit-roles.png" alt-text="Screenshot of the edit roles flyout page" lightbox="/defender/media/defender/m365-defender-rbac-edit-roles.png":::
55
56
@@ -60,7 +61,7 @@ The following steps guide you on how to edit roles in Microsoft Defender XDR Uni
60
61
61
62
To delete roles in Microsoft Defender XDR Unified RBAC, select the role or roles you want to delete and select **Delete roles**.
62
63
63
-
If the workload is active, by removing the role all assigned user permission will be deleted.
64
+
If the workload is active, all assigned user permission are deleted by removing the role.
64
65
65
66
> [!NOTE]
66
67
> After deleting an imported role, the role won't be deleted from the individual product RBAC model. If needed, you can re-import it to the Microsoft Defender XDR Unified RBAC list of roles.
@@ -76,7 +77,7 @@ The Export feature enables you to export the following roles data:
76
77
- The assigned data sources
77
78
- The assigned users or user groups
78
79
79
-
When a role has multiple assignments, each assignment will be represented as a separate row in the CSV file.
80
+
When a role has multiple assignments, each assignment is represented as a separate row in the CSV file.
80
81
81
82
The CSV also includes a snapshot of the Defender XDR Unified RBAC activation status for each workload available on the tenant.
82
83
@@ -97,7 +98,7 @@ The following steps guide you on how to export roles in Microsoft Defender XDR U
97
98
98
99
:::image type="content" source="/defender/media/defender/m365-defender-rbac-export-roles.png" alt-text="Screenshot of the export roles page" lightbox="/defender/media/defender/m365-defender-rbac-export-roles.png":::
99
100
100
-
A CSV file containing all the roles data will be generated and downloaded to the local machine.
101
+
A CSV file containing all the roles data is generated and downloaded to the local computer.
0 commit comments