Microsoft Developer: You Still Should Have Anti-Virus With Windows Subsystem For Linux

Written by Michael Larabel in Microsoft on 14 February 2019 at 12:27 AM EST. 21 Comments
While disabling Windows Defender or other anti-virus programs may partially help offset the performance losses imposed by running Windows Subsystem for Linux, a.k.a. "Bash for Windows" or Ubuntu and other distributions running natively atop Windows 10 and now Windows Server 2019, it's not the root cause of the I/O performance bottleneck and is not a recommended course of action.

The main performance shortcoming of Windows Subsystem for Linux (WSL) has been in the area of I/O. In CPU/system benchmarks we routinely see Windows 10 WSL with Ubuntu and other distributions performing very well, but when it comes to disk reads/writes, it's drastically slower than bare metal Linux installs and in some cases much slower still than dedicated virtual machines. Disabling Windows Defender or other anti-virus/anti-malware utilities only partially offsets this I/O overhead.

Rich Turner of Microsoft has issued a fresh warning over not disabling Windows Defender even for WSL performance purposes. This warning comes after Windows Defender was able to spot a malicious Node.js dependency in some code running under WSL.

As for the WSL I/O performance coming in short, Rich Turner also commented, "We're working across several teams right now to figure out an effective solution to this perf issue and despite the perf impact. In the meantime, we recomemnd patience. We do NOT recommend disabling Defender (or your chosen 3rd party anti-malware suite), nor do we recommend you exclude WSL folders nor your source folders."

We've been hearing for months now that they are working to address the WSL I/O problems... Hopefully a Windows update in 2019 will finally address this issue.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via

Popular News This Week