@@ -12,12 +12,14 @@ ms.collection: - mde-macos ms.topic: troubleshooting-general ms.subservice: macos-ms.date: 06/20/2025+ms.date: 08/11/2026 appliesto:   - Microsoft Defender for Endpoint Plan 1   - Microsoft Defender for Endpoint Plan 2   - Microsoft Defender for Individuals +ai-usage: ai-assisted+ms.custom: msecd-doc-authoring-1015 --- # Troubleshoot performance issues for Microsoft Defender for Endpoint on macOS @@ -56,7 +58,7 @@ To troubleshoot and mitigate performance issues, follow these steps:    | Device isn't managed by organization | **Terminal**: In Terminal, run the following command: `mdatp config real-time-protection --value disabled` |    | Device is managed by organization | See [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md). |    -   If the performance problem persists while real-time protection is off, the origin of the problem could be the endpoint detection and response component. In this case, contact customer support for further instructions and mitigation.+   If the performance problem persists while real-time protection is off, the issue isn't limited to antivirus scanning. Continue with [Troubleshoot core or endpoint detection and response performance issues](#troubleshoot-core-or-endpoint-detection-and-response-performance-issues).     1. Open Finder and navigate to **Applications** > **Utilities**. Open **Activity Monitor** and analyze which applications are using the resources on your system. Typical examples include software updaters and compilers. @@ -152,6 +154,35 @@ To troubleshoot and mitigate performance issues, follow these steps:  See the guide on our support page for [Behavior Monitoring](behavior-monitor-macos.md). +## Troubleshoot core or endpoint detection and response performance issues++Use this workflow when `wdavdaemon` or `wdavdaemon_enterprise` has high resource use, or when the issue continues while real-time protection is disabled.++1. Reproduce the issue and confirm the affected Defender process in **Activity Monitor** or by running `top`.+1. Record the following information:++   - Workload.+   - Start and end times.+   - CPU and memory use.+   - Device model and processor.+   - macOS and Defender versions.+   - Enforcement mode.+   - Other security or monitoring products.++1. Collect hot event sources during the affected period:++   ```bash+   sudo mdatp diagnostic hot-event-sources --time=360+   ```++   The command creates a report that identifies applications and processes producing the most Endpoint Security events. Run the collection only while the issue is occurring.+1. Collect performance data by following the instructions in [Run the client analyzer on macOS and Linux](overview-client-analyzer.md).+1. If another endpoint security product is installed, confirm that the products are configured for the intended coexistence mode. See [Microsoft Defender for Endpoint and other security solutions](mde-side-by-side.md).+1. Contact Microsoft Support and provide the process measurements, hot event source report, Client Analyzer output, and exact time window when you reproduced the issue.++> [!IMPORTANT]+> An antivirus exclusion doesn't suppress EDR or other Endpoint Security events. Don't add broad antivirus exclusions to address `wdavdaemon` or `wdavdaemon_enterprise` resource use unless antivirus scanning is also identified as a contributor.+ ## Troubleshoot performance issues using Microsoft Defender for Endpoint Client Analyzer  The Microsoft Defender for Endpoint Client Analyzer (MDECA) can collect traces, logs, and diagnostic information in order to troubleshoot performance issues on [onboarded devices](onboard-configure.md) on macOS.@@ -160,4 +191,3 @@ To run the client analyzer for troubleshooting performance issues, see [Run the  > [!NOTE] > The Microsoft Defender for Endpoint Client Analyzer tool is regularly used by Microsoft Customer Support Services (CSS) to collect information such as (but not limited    to) IP addresses, PC names that help troubleshoot issues you might be experiencing with Microsoft Defender for Endpoint. For more information about our privacy statement, see [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement).-