MT.1157 - CPU Load Factor should be optimized (20-30%).

Contributed by Boris Drogja with Olugbenro OgundipeAll contributors →

Overview

Checks that the average CPU load factor is configured between 20-30% in the assigned Microsoft Defender Antivirus policies.

Inappropriate CPU load settings may impact system performance or reduce scan effectiveness, leaving endpoints vulnerable to threats.

Remediation action:

1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
2. Edit the relevant Microsoft Defender Antivirus policy
3. Set Average CPU Load Factor to 20-30%

If your antivirus settings are split across several policies, this setting only needs to be set in one of them, as long as that policy is assigned to every device that needs it. No other assigned policy should set a different value: Intune does not merge this setting, so a device that receives both values may end up with either one, or none.

Related links

• Policy merge and conflicts for Antivirus policy settings
• Configure Microsoft Defender Antivirus
• Microsoft Endpoint Manager

Test Metadata

Field	Value
Test ID	MT.1157
Severity	Low
Suite	Maester
Product	Defender
Related products	Intune
Feature	Endpoint antivirus
Area	Devices and endpoints
Resource type	Policy
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
PowerShell test	Test-MtMdeCpuLoadFactor
Services	Graph

Source

• Test: tests/maester/defender/Test.MT.1157.ps1
• Documentation: tests/maester/defender/Test.MT.1157.md