A newly installed Win 10 Pro in Hyper-V (4GB Ram, 32GB HDD) with all latest updates and NOT a single software had been installed yet! Except these two tools:

1. Classic Shell
2. 7zip

Both of them were downloaded from official site.

After installing, the windows were cleaned using cleanmgr to release all the HDD space.

And that stupid windows defender had been running and scanning since yesterday night. Non stop.

Luckily it was not installed on my SSD, otherwise it will generate > 1TB of write in less than 3 hours. (I used to have this problem on the host, and that is the reason why I have disabled windows defender)


WTH is Windows Defender doing? If it is scanning, it shouldn't write too extensively to the HDD.

Furthermore there is NOTHING To scan. I have only a 32GB HDD, and with less than 10GB of files installed (including the OS)

This post has been edited by CKKwan: Jun 15 2017, 08:15 AM


Attached thumbnail(s)

Because you are not monitoring its performance.

If you goto the Process tab, it will shows "Antimalware Service Executable" is the one that hogging the HDD.

Besides, all the CPU and HDD activities drop to near zero (0) once I have disabled Windows Defender using gpedit.

The Allocated RAM is 4GB. Hyper-V will dynamically increase / decrease the RAM available.

Besides, there isn't any software running at the moment. Only Windows Defender was running at the background.

But in this case, I do not think that the high HDD usage is caused by the dynamically allocated RAM.

Besides dynamically allocation of Memory, Hyper-V also dynamically scale back the CPU time allocated to the VM. That is why a lot of time you will notice CPU usage is very high.

Windows Defender shouldn't use so much memory that it causes the OS to start swapping into HDD. When memory is not sufficient, Hyper-V should first allocate more from the host (until its limit is hit) before telling the OS that there is no sufficient memory and triggered a swap. Besides, Windows Defender is (the only) actively running, if the OS wish to swap some thing out of memory, it should have swap something (which is idle) else instead of Windows Defender.

The theory (deep inside) will basically affect all applications running inside hyper-v. Which is a MORE serious problem than just Windows Defender alone.

If whatever you said is true, then you should have noticed that your VM is behaving unexpectedly.

That is fine, I only disagree with your weird theory