Share via

Windows 11 + Device Guard slows down CreateProcess + pipe output capture (ReadFile waits longer)

S, Ananth 0 Reputation points
2026-04-17T09:48:27.0733333+00:00

Hi Microsoft Support Team,

We are seeing a significant performance difference between Windows 10 and Windows 11 when Device Guard (VBS/HVCI/WDAC) is enabled, and we would like your guidance on why this occurs.

Issue description (technical)

Our application repeatedly launches child processes (both .exe and cmd.exe /C calls for .bat scripts) using CreateProcess with redirected stdout/stderr via anonymous pipes. After launching each child, the parent reads stdout/stderr using blocking ReadFile() loops until ERROR_BROKEN_PIPE (i.e., until the child and any inheriting descendants close the stdout/stderr write handles).

On Windows 10 with Device Guard enabled, the overall runtime is ~5–7 minutes. On Windows 11 with Device Guard enabled, the same workload takes ~20–35 minutes (varies by machine). The additional time is consistently observed while waiting for the redirected pipe reads to complete (the “read until broken pipe” logic), which effectively means the child process chain takes longer to finish/close handles.

Key technical points

  • Child creation: CreateProcess(..., bInheritHandles=TRUE, ...)
  • Stdout/stderr are redirected using CreatePipe and passed via STARTUPINFO (STARTF_USESTDHANDLES)
  • Parent reads stdout/stderr using ReadFile() in a loop until ERROR_BROKEN_PIPE
  • This pattern runs many times (for each external command)

Requested clarifications

  • Are there known Windows 11 behavioral changes or performance regressions under Device Guard (VBS/HVCI/WDAC) that increase:
    • process creation / image validation time (CreateProcess),
      • module/DLL load validation time, and/or
        • the lifetime/behavior of cmd.exe / console-hosted processes with redirected std handles?
        • Can Device Guard on Windows 11 cause additional delay in closing inherited stdout/stderr handles (e.g., due to extra helper processes or different console host behavior), making ReadFile() wait longer for ERROR_BROKEN_PIPE?
        • Are there specific Windows event logs/counters you recommend to confirm whether the delay is due to Code Integrity validation overhead (even when no blocks/audits occur)?

Observed behavior

  • No CodeIntegrity “error” events are present, but runtime increases significantly only when Device Guard is enabled on Windows 11.
  • Without Device Guard, the same workload is fast on both OS versions.

Please let us know what Windows 11 + Device Guard components could explain this increased wait time and what diagnostic data you would like us to collect (ETW providers, event channels, performance counters, etc.) to validate the root cause.

Thanks,
Ananth S
<PII removed>

Windows development | Windows API - Win32

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Taki Ly (WICLOUD CORPORATION) 1,500 Reputation points Microsoft External Staff Moderator
    2026-04-20T09:46:26.32+00:00

    Hi @S, Ananth ,

    It is difficult to point to a single exact cause without analyzing system traces, but based on similar issues, the extra checking from Device Guard and Antimalware is likely the problem. You can check a few things below:

    1. Antimalware Inspection Delays (Defender + WDAC) ReadFile() is waiting longer to receive the ERROR_BROKEN_PIPE state usually means that the write end of the anonymous pipe is being kept open longer than expected.

    • On Windows 11 with Device Guard enabled, security components like Windows Defender's Real-Time Protection (RTP) and its file system filter (AMFilter) often perform much deeper, synchronous scanning for every new cmd.exe or .bat process created.
    • While these security processes inspect the child environment, they can temporarily hold onto the inherited pipe handles, delaying the process termination and the ERROR_BROKEN_PIPE signal.
    • A quick troubleshooting step is to try adding a temporary folder exclusion in Windows Security (for the directory containing your .bat scripts or the parent application). If the runtime drops from 30 minutes back to 5-7 minutes, the Antimalware inspection under the Device Guard environment is your bottleneck.

    2. Code Integrity (CI) and HVCI Overhead Windows 11 has updated and applied stricter enforcement for VBS and HVCI (Memory Integrity). Even if there are no audit/block events, the image validation process (calculating hashes, checking signatures) inside ci.dll during CreateProcess can consume more resources compared to Windows 10. When your application repeatedly spawns hundreds of short-lived child processes, this overhead accumulates very quickly.

    3. Suggested Diagnostic Tools To see exactly what Windows 11 is doing during that 20-35 minute window, capturing an Event Tracing for Windows (ETW) log is the best approach. I suggest recording the trace by these steps below:

    1. Open the Start menu, type wprui (Windows Performance Recorder), and select Run as administrator.
    2. Click on More options. Then, under "Select additional profiles", expand Resource Analysis and check CPU usage along with File I/O activity. (You can uncheck First level triage).
    3. On the right side, change the Logging mode from Memory to File.
    4. Click Start. (If the software throws an "Access Denied - 0x80070005" error, it proves that your strict WDAC policy completely blocks ETW tracing, and you may need to test this on a machine with Device Guard configured in Audit mode).
    5. Reproduce the slow CreateProcess behavior for about 5 to 8 minutes, then click Save in the WPR window to output the .etl trace file.

    Afterward, you can open this .etl file using Windows Performance Analyzer (WPA):

    • Open the System Activity -> Generic Events graph. Look at the Provider Name column.
    • Check if providers like Microsoft-Antimalware-Engine, Microsoft-Antimalware-RTP, or Microsoft-Windows-CodeIntegrity show massive event counts that align perfectly with the Microsoft-Windows-Kernel-Process (process creation) events.

    Hope these suggestions help narrow down the issue. If you found my response helpful or informative, I would greatly appreciate it if you could provide feedback by following this guide.

    Thank you.

    Was this answer helpful?

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.