I see about a 100x slowdown on some applications[0] and IO heavy operations with defender in win11. It's unbelieveable how slow it is. I was a huge proponent of it in Win10, but I'm finding it hard to do so now.

[0] The software I'm using does a scan over a few hundred thousand files to read file headers. Without windows defender it takes about 30 seconds, but with defender it takes about 300.

It adds a non trivial amount of time for each file access.

Defender slows down build times significantly.

You can set exclusions of course, but it does get tedious because every time you have a new project you need to add exclusions for its folder and the toolchain. Then every time a toolchain is updated (eg .../gcc/11.5 changes to gcc/11.5.2 you have to enter the 20 new exe exclusions and of course windows won't let you mass delete the old ones so it's click->confirm->click->confirm x50).

I might not do it myself but I can see why someone would just say "enough is enough".

On Win11, it reenables itself after a short while using a system service, in true Robin Hood & Friar Tuck malware[1] fashion.

[1] https://users.cs.utah.edu/~elb/folklore/xerox.txt

> You can reliably disable it with Group Policy Editor.

It does not work. You can disable _some things_ , but not the whole.

That's only available on Pro.

I am surprised that ever worked. I was confident Win10 did verification that system files were in place and matched a hash or some other integrity mechanism.

And then Clippy sneaks up behind you, and whispers menacingly in your ear, "It looks like you're installing an operating system."

The safer option is to build your own install media using an unattend file. Here's an unattend file generator https://schneegans.de/windows/unattend-generator/