How to automate the collection of Defender performance data?

Question

Our IT department requested to collect ETW data from Defender during MSBuild-driven builds. We have intermittent build failures that are evidently caused by Defender (well, its user mode service) sitting on files with exclusive access. The issue is elusive, a classical Heisenbug. And despite attempts to reproduce this while recording ETW data, I haven't had luck reproducing it after two dozen or so tries.

The instructions state to use New-MpPerformanceRecording -RecordTo <recording.etl> followed by Get-MpPerformanceReport -Path <recording.etl> .... The respective documentation from Microsoft can be found here.

Now my main gripe with the process is that New-MpPerformanceRecording requires to:

3. Press ENTER to stop and save recording, or Ctrl+C to cancel recording.

That means I cannot script the performance recordings along with the builds and always need to attend them. It's wasting a lot of time I don't really have to keep coming back to a window to look whether or not already to press ENTER.

Question: How can I automate the process end-to-end? I am acquainted with PowerShell scripting, but how to get around this silly prompt and have it save the data is beyond me. Anything that cancels the capture means I lose the data.

PS: the issue is not about speed ("performance") as such, it's much more about performing at all, because Defender keeps failing our builds. But I get why they would want ETW or trace logging details.

Answer 1

Firstly, I'll incorporate and cite some key elements from the Description: New-MpPerformanceRecording post, which could offer valuable insights into vendor support and its implications, at the very least.

This New-MpPerformanceRecording cmdlet provides an insight into problematic files that could cause a degradation in the performance of Microsoft Defender Antivirus. This tool is provided "AS IS", and is not intended to provide suggestions on exclusions. Exclusions can reduce the level of protection on your endpoints. Exclusions, if any, should be defined with caution.

For more information on the performance analyzer, see Performance Analyzer docs.

Additionally, I've identified a potential workaround idea per what's outlined in Example 2 of the Microsoft post's section which I'll cite and reference key points below for clarity first.

Example 2: Collect a performance recording for remote PowerShell session

$s = New-PSSession -ComputerName Server02 -Credential Domain01\User01 
New-MpPerformanceRecording -RecordTo C:\LocalPathOnServer02\trace.etl -Session $s 

The above command collects a performance recording on Server02 (as specified by argument $s of parameter Session) and saves it to the specified path: C:\LocalPathOnServer02\trace.etl on Server02.

Parameters: New-MpPerformanceRecording

-RecordTo

Specifies the location in which to save the Microsoft Defender Antimalware performance recording.

-Session

Specifies the PSSession object in which to create and save the Microsoft Defender Antivirus performance recording. When you use this parameter the RecordTo parameter refers to the local path on the remote machine. Available with Defender platform version 4.18.2201.10

Potential Workaround

Create a remote interactive session with New-PSSession and store it in a variable (e.g. $s). Then, use the variable with the -Session parameter of New-MpPerformanceRecording

Once sufficient time has passed to collect necessary events, use Remove-PSSession along with the respective variable (e.g. Remove-PSSession $s) to end the remote session and halt the session capture operations.

PowerShell Example 1

$s = New-PSSession -ComputerName Server02 -Credential Domain01\User01
New-MpPerformanceRecording -RecordTo C:\LocalPathOnServer02\trace.etl -Session $s

## After enough time has passed, run this command or schedule it
Remove-PSSession $s

PowerShell Example 2

$s = New-PSSession -ComputerName Server02 -Credential Domain01\User01

Invoke-Command -Session $s -ScriptBlock {
    New-MpPerformanceRecording -RecordTo C:\LocalPathOnServer02\trace.etl
}

## After enough time has passed, run this command or schedule it
Remove-PSSession $s

Answer 2

You could try something like this:

# Define the path for recording.etl
$etlPath = "C:\Path\To\Your\Recording.etl"

# Start the performance recording
New-MpPerformanceRecording -RecordTo $etlPath

# Sleep to allow time for the recording to capture data (adjust as needed)
Start-Sleep -Seconds 60

# Stop the performance recording
Stop-MpPerformanceRecording

Answer 3

avoid the powershell and use the native commands:

&"C:\Windows\system32\wpr.exe" -start C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ConfigDefenderPerformance\MSFT_MpPerformanceRecording.wprp!Scans.Light -filemode -instancename MSFT_MpPerformanceRecording

&"C:\Windows\system32\wpr.exe" -stop C:\temp\Defender.etl -instancename MSFT_MpPerformanceRecording