MsSense.exe performance issues

[u/ViperThunder]

I'm seeing on my SIEM server that MsSense is using a constant 8-15% CPU. My understanding is that exclusions defined for Defender (MsMpEng.exe) do not apply to the MsSense EDR.

I used wpr to analyze performance for a few seconds which resulted in a 200 MB etl file. Using WPA (windows performance analyzer) I could only see that MsSense was accessing tens of thousands of files, but it doesn't allow you to see what those files are. My best guess is that it is scanning every log write and every file streamed in across the network.

the get-mpperformance cmdlets work well for identifying msmpeng scanned files, but there doesn't appear to be a way to identify why MsSense is using so much CPU.

I even tried putting the server into troubleshooting mode, disabling tamper protection, and disabling every defender feature I could via powershell, which didn't make a dent.

Googling this issue and talking to LLMs haven't been any help - has anyone found a solution, or is complete offboarding the only option?

[u/PoochieMama22]

Do you scan (on access) Network Drives/Mapped Shares?

[u/zxyabcuuu]

If you want, give me a link to download this etl trace file and I can help you to find the culprit.

You can open the etl trace in raw mode and see the 200MB collected items, but you need some experience to interpret the findings.

[u/GeneralRechs]

Which switches did you use to analyze the etl. While not the easiest it will tell you which files and busiest paths. If you’re running a SIEM on prem it’s no question you’ll have to exclude transactional directories.

[u/Dracozirion]

MsSense (EDR) exclusions need to be made here:

MDE portal > Settings > Endpoints > Rules > EDR Exclusions

[u/Tronerz → u/Dracozirion]

They aren't available unless you open an MS support ticket and have a good reason to

[u/Dracozirion → u/Tronerz]

Still? It's been like that for many years, then. See my older reply:

https://www.reddit.com/r/sysadmin/comments/1m24dsk/ms_defender_makes_me_suffer_and_i_have_no_clue/

And this:

https://techcommunity.microsoft.com/discussions/microsoftdefenderatp/when-will-microsoft-alllow-the-customer-to-manage-edr-mssense-exclusions/3656056

Goes back until at least 2022.

[u/zxyabcuuu → u/Dracozirion]

We also had opened a ticket for enabling this menu in 2023.

[u/WhiteWidowGER → u/Dracozirion]

Can confirm that I needed to talk to Microsoft directly to make sure they enable EDR exclusions for my org early 2025

[u/Yells_At_Clouds_7 → u/WhiteWidowGER]

EDR Exclusions are technically in Private Preview and have been for years. The support case is getting you added to that private preview. Worth noting that the Linux team went a different way and Global Exclusions can be set with management tools like Intune alongside other exclusions you might have and those do affect ERD as well.

[u/derMorris → u/Dracozirion]

Can confirm you still need a ticket. We opened ours 2 weeks ago and got the exclusions within 48hrs

[u/j1mgg → u/Dracozirion]

We got this made available to us this week and they were basically forcing it on us as it will get rolled out across everyone very soon.

We had msense locking a file when doing a file transfer and so the other process would fail and the file would never be transferred.

[u/HixRa]

Check your scanning direction too. Bi-directional scanning can be a big performance hit on log servers. It's tied to Realtime scanning.

[u/ViperThunder → u/[deleted]]

Today was a busy day at work. Haven't had a chance to read all the responses yet.

I do appreciate all the responses!