ProcessHacker MsMpEng.exe priority changing puzzle

[arpruss]

I can change the priority of MsMpEng.exe (Windows Defender) to idle from the ProcessHacker GUI, assuming I started ProcessHacker as admin (I verified that the change worked using wmic). But if I try to set it from an administrator commandline using:

"ProcessHacker.exe" -c -ctype process -cobject MsMpEng.exe -caction priority idle

I get an access denied error. It makes no difference whether I add -elevate or not to the commandline, and it makes no difference whether the ProcessHacker GUI is running or not.

Additionally, if I set ProcessHacker to save the priority, it does write it to the usernotesdb.xml file, but when I terminate MsMpEng.exe, it starts again with default priority.

I want to automate the priority change as my laptop is overheating from Windows Defender. I suppose I could write an AutoHotKey script to do it in the ProcessHacker GUI, but that seems really kludgy.

[dmex]

I get an access denied error.

The command line doesn't allow changing these values for protected processes (Defender). Also the command line feature has been removed entirely in newer versions.

when I terminate MsMpEng.exe, it starts again with default priority.

The usernodes plugin (or any other plugin) doesn't allow changing these values for protected processes (Defender). A workaround was added when you select the IFEO menu option to configure Windows to change the priority instead of the plugin changing the priority:

[arpruss]

Thanks! What's the IFEO option?

I suppose another solution is to recompile old source to allow changing the values for protected processes?

[arpruss]

I ended up just scripting it with pywinauto. Here it is in case anybody else wants it. It sets MsSense and MsMpEng to the lowest cpu and i/o priorities, and seems to help my laptop not overheat.

from pywinauto.application import Application
exe = "c:/Program Files/Process Hacker 2/ProcessHacker.exe"
try:
    app = Application().connect(path=exe)
except:
    app = Application().start(exe)
window = app.Process_Hacker
window.set_focus()
window.type_keys('^kMsMpEng.exe')
window.click_input(button='right',coords=(50,180))
window.type_keys('pi')
window.click_input(button='right',coords=(50,180))
window.type_keys('iv')
window.type_keys('^kMsSense.exe')
window.click_input(button='right',coords=(50,180))
window.type_keys('pi')
window.click_input(button='right',coords=(50,180))
window.type_keys('iv')
window.type_keys('^k^h')
window.minimize()

[dmex]

@arpruss

Why? You can just use the IFEO menu or set the registry key manually. You don't need to script anything or run any programs.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\PerfOptions]
"CpuPriorityClass"=dword:00000003

[arpruss]

I was using ProcessHacker 2.39, so I didn't have the IFEO option. In version 3, I get the IFEO option, and it works for MsMpEng.exe, but I get Access Denied for MsSense.exe when setting priority, with or without the IFEO option.

[dmex]

@arpruss

There's already an IFEO entry for MsSense.exe in the registry. The permissions for the registry key don't allow administrators to make changes so you'll have to take ownership of the key and grant administrators access.

[arpruss]

Alas, the way the laptop is locked down, I get permission denial when I try to change the owner to Administrators.

[dmex]

The next version fixes all these issues 👍