Adaptive Threat Protection slows down computer office applications

[roberto.periale]

Hi,

Computer with Windows 10 21H1 and ATP 2021 november update (10.7.0.3252) when user try to open a word document or excel worksheet the microsoft application become unresponsive and disk access resources become 100% due to ATP process scan.

After 1 minutes the scan finish and word is again responsive.

This issue appears after 21h1 update.

Any suggestion?

Thank you

[rfranci]

Hi @roberto.periale ,

Thankyou for reaching us on community !

Can you conform whether the machines are connected to internet ?
because if there is GTI reachability issue when ATP is scanning the file it will cause high CPU usage and cause delays in opening an application.

To conform this, i would recommend disabling GTI option from ATP and check if that resolves the issue temporarily.

If it does you will have to allow GTI communication in case if it is getting blocked by internal firewall:
 https://kc.mcafee.com/corporate/index?page=content&id=KB93324
https://kc.mcafee.com/corporate/index?page=content&id=KB79640

How to test if GTI is reachable:
https://kc.mcafee.com/corporate/index?page=content&id=KB53733

I hope you find this helpful.

-Rohit Francis 
Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[roberto.periale]

Hi,

thank you I see that also 1 GB of memory is used.

In 1 case is a server and probably is correct, I need to investigate, but in different case are computers able to browse internet.

Thank you

[mhk8302]

Did you have any luck figuring out this issue? We have the exact same thing going on with just a couple users. Even our nuclear options of reimaging the affected computers doesn't work. It only affects one user on their profile, any other users aren't affected. And this user isn't doing anything other than just logging in and opening up a blank document and ATP will go nuts.

[roberto.periale]

Hi,

We solved after permit GTI connection. What logs do you get?