Counter Control
Version 1.2
2022 July 6

Kevin Glynn
glynnk9@gmail.com

New Features
------------
- added support for more Intel CPUs.
- improved support for high DPI 4K monitors.
- added an About box.

This program monitors and logs the IA32_FIXED_CTR_CTRL register located at MSR 0x38D. This program supports most Intel CPUs released since 2008. Counter Control does not support any AMD CPUs. 

Background
----------
Intel CPUs have three fixed function performance monitoring counters available for each CPU thread. Each counter can be used by the operating system or by user software. These counters can be programmed to one of four possible modes.

Mode 0 - Disable
Mode 1 - OS (Ring 0)
Mode 2 - User (Ring > 0)
Mode 3 - All Ring Levels

These counters are a shared resource. That means it is possible to have two programs running on a computer that are both trying to use the same counters at the same time. This situation is like having two people trying to monitor two different events with a shared stopwatch. The results will be unpredictable. 

Popular monitoring programs like HWiNFO, OCCT, Core Temp, and ThrottleStop all use two of these counters and set both counters to mode 3. This allows all of these monitoring programs to happily co-exist, without interfering with each other. 

It has recently been discovered that the Windows Defender Real-time Protection notification feature is randomly setting the three fixed function counters to mode 2. This can happen when a computer first boots up or it can happen at any time after that. While Windows Defender is running in the background, it can start and stop or continuously try to change these counters to mode 2 at any time. 

HWiNFO Reduced Core Effective Clock
-----------------------------------
Have you ever noticed HWiNFO reporting a reduced Core Effective Clock speed when the CPU is fully loaded? Windows Defender and HWiNFO fighting over control of these counters could be the reason why. Windows Defender trying to use these counters can interfere with HWiNFO's ability to correctly measure and report the Core Effective Clock speed.   

Reduced Core i Performance
--------------------------
A much bigger problem is that when Windows Defender is using these counters, the algorithm Windows Defender runs can significantly reduce performance. A Core i9-10850K running at 5000 MHz showed a decreased Cinebench R23 benchmark score of ~1000 points (16800 vs 15800). Owners of Intel Core i 8th, 9th, 10th and 11th Gen, both desktop and mobile CPUs, have reported reduced or inconsistent performance because of this issue.

How to Monitor
--------------
The Counter Control app will inform users if any software is presently using the Intel fixed function counters and for how long they have been in use. It also logs this information. Here are some typical values that Counter Control reports.  

Not Used - 0x000
The three fixed function counters are stopped. None of the counters are presently being used.

Defender - 0x222
All three fixed function counters are programmed to mode 2. This is the value that Windows Defender sets these counters to when it is using them. 

Normal - 0x330
Two counters are programmed to mode 3. One counter is programmed to mode 0 and is not being used. This is normal. Most monitoring programs that use these counters will program the counter control register to this value.  

Warning - 0x332
This is shown when two counters are being used normally by monitoring software while the third counter has been set to mode 2, likely by Windows Defender. This is a warning that two different programs might be fighting over control of the shared counters. You might see the counter control register constantly changing between 0x222 and 0x332. This is what you will see when running HWiNFO if Windows Defender is trying to use the IA32_FIXED function counters at the same time.

How To Test
-----------
If Counter Control is reporting Defender 0x222 and you are not sure if this is a problem or not, run Cinebench R23, set Minimum Test Duration to Off and record your score. Press the Reset Counters button, re-run Cinebench R23 and then compare your score. A noticeable improvement in your Cinebench results will confirm if your computer has this problem or not. 

* Not Recommended *
Disable Real-time Protection
----------------------------
Some users have decided to disable the Windows Defender Real-time Protection notification feature.  
Windows Pro users can open the Local Group Policy Editor (gpedit.exe) and navigate to this key.  

Computer Configuration / Administrative Templates / Windows Components / Microsoft Defender Antivirus / Real-time Protection

If you set, "Turn off real-time protection" to Enabled, this seems to prevent Windows Defender from starting any of the system counters and it prevents this part of the Windows Defender algorithm from reducing performance. Here is the explanation displayed in the Local Group Policy Editor.

"This policy setting turns off real-time protection prompts for known malware detection."

If you are using Windows Home or do not have access to gpedit.exe, you can use regedit to change this setting. 
Run regedit.exe and navigate to this folder.

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection

When you are in this folder, if you do not see a value called DisableRealtimeMonitoring, right click to create a new DWORD value. Name this DWORD value, DisableRealtimeMonitoring and set this to a value of 1.

Recommended Fix
---------------
ThrottleStop 9.5 has a new feature in the Options window called Windows Defender Boost. Checking this box will help ensure maximum performance and accurate Core Effective Clock monitoring whether Windows Defender Real-time Protection is enabled or not. 
