Does EDR slow down my computer?

You may experience slowdowns on your workstation. You might wonder if this is related to the Endpoint Detection & Response (EDR) software installed on your machine.

Usual reasons for slowdown

A slowdown can have several causes:

• A high workload on the computer (demanding programs, saturated memory resources, full disk)

• A network or server connection problem

• A background update or process

• A software malfunction

EDR may, in some cases, use more resources during occasional scans, but it is generally not the primary cause of a prolonged slowdown.

Qualify the slowdown

To better understand the situation and identify the cause, gather these four pieces of information:

1. Is the slowdown widespread? Does it only affect your computer or multiple machines in your organization?

2. If it's only one computer, which one exactly? Note the name or identifier of the affected machine.

3. What is the nature of the slowdown?

   1. Is the computer itself slow: Applications that are difficult to open, frozen cursor, system slowdowns?

   2. Or is the connection to a server or online service slow?

4. Have all other security tools been completely uninstalled? In particular, antivirus software and any other EDR software already installed.

Troubleshoot the slowdown

To help us troubleshoot, please follow these three steps:

1. Make sure antivirus is completely uninstalled, including all the antivirus related services

2. Uninstall and re-install the EDR from the end-point

3. Investigate by running this command corresponding the host platform and forward us the results at [email protected] :

• Windows (PowerShell Command)

try {
    # Workstations
    Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction Stop | Select-Object displayName, productState, @{Name="Services_Associes"; Expression={
        $search = $_.displayName -replace "Windows ", "" -replace "Microsoft ", "" -replace "Sensor", "" -replace "Agent", "" -replace "Antivirus", ""
        $search = $search.Trim()
        
        if ($_.displayName -match "Defender") {
            $svcs = Get-Service -Name "WinDefend", "Sense", "WdNisSvc" -ErrorAction SilentlyContinue
        } else {
            $svcs = Get-Service | Where-Object { $_.DisplayName -match $search -or $_.Name -match $search }
        }
        
        if ($svcs) { ($svcs | Sort-Object Status -Descending | ForEach-Object { "$($_.Name):$($_.Status)" }) -join " | " } else { "Aucun service trouvé" }
    }} | Format-List | Out-String
}
catch {
    # Servers (Fallback in case where namespace "root/SecurityCenter2"" doesn't exist)    
    $keywords = "WinDefend", "Sense", "Falcon", "Sophos", "Sentinel", "McAfee", "Symantec", "Carbon", "Cylance", "Trend", "Eset", "Kaspersky", "Bitdefender"
        Get-Service | Where-Object { 
        $n = $_.Name; $d = $_.DisplayName; 
        ($keywords | Where-Object { $n -match $_ -or $d -match $_ }) 
    } | Group-Object -Property DisplayName | ForEach-Object {
        [PSCustomObject]@{
            displayName       = $_.Name
            productState      = "N/A (Serveur)"
            Associated_Services = ($_.Group | Sort-Object Status -Descending | ForEach-Object { "$($_.Name):$($_.Status)" }) -join " | "
        }
    } | Format-List
}

• Linux / macOS

ps aux | grep -iE "falcon|mdatp|wdav|defend|sophos|sentinel|mcafee|cma|nails|carbon|cylance|symantec|eset|kav|clam|trend" | grep -v grep | awk '{print "Process: " $11 " | PID: " $2 " | CPU: " $3 "%"}'

Send it over to Stoïk

Once these information have been gathered, send it to "[email protected]".

This will allow us to analyze the situation more quickly, and distinguish between a local (computer), network (connection/server), or installed EDR problem.