Long/Slow InTouch View ( 2023 R2 SP1) Application Startup Times and Microsoft Defender on Windows Server 2022

Try disabling the defender and see the start-up time to see if that's the issue, if it improves then you can look at exclusion folders and ports for microsoft defender or you can use a behaviour based end point protection that OT friendly and does not interfere with your OT softwares and environment, using IT end point protections like Defender, Symantec is not a good strategy

Thank you for the reply. When I applied the exclusions the time came down from 5 min to 40 seconds. When disabling defender the startup time is normal ( 10 sec). So it is 100% defender is the culprit. Do you have any more information regarding 'behaviour based end point protection' ( never heard of it before)

https://bluegoatcyber.com/blog/signature-vs-anomaly-based-detection-which-is-more-effective/ have a look at this for concept, and we use Cylance protect as end point protection which does a really good job in the OT environment and i dont need to exclude any folder and it doesnt block any ports , so faster and safer SCADA and OT systems

Microsoft Defender is worst thing you can use in the OT environment, i have also use Trend Micro, Sentinel One and are pretty good

Thank you very much. Now wish me luck trying to convince IT to switch to behaviour based end point protection

Well the first person you need to convince is operations team and tell IT team that lag and downtime will be their head ache if they use an IT end point in OT environment, make it more their responsibility than your responsibility

So, I spoke with the client's IT, and—just as expected—they basically told me to take a hike. Company policy is Defender, no exceptions. I think I'll respond with something like, "Enjoy the one-minute startup time, and whatever you do, don’t close the application!"

So, I spoke with the client's IT, and—just as expected—they basically told me to take a hike. Company policy is Defender, no exceptions. I think I'll respond with something like, "Enjoy the one-minute startup time, and whatever you do, don’t close the application!"

Well get a signed document specifying your recommendations and saying due to client's approach in IT policy they have to live with the given slowness , writing and signatures are much more powerful