Windows issue: Defender collides with FMAPOService

[German]In April 2022, I had reported issues with Windows Defender on Windows 10 (20H2). From extreme RAM usage to startup problems with Word or effects like black screen after user login has been observed/reported. Some issues were supposedly fixed by a Defender signature update, but users continue to have issues. Now an administrator from France contacted me by mail. Based on my blog posts, he was able to trace the problem back to a collision between Defender and FMAPOService.

Trouble with Defender

In April 2022  I had reported about problems with Windows Defender under Windows (see Defender Signaturen verursachen extreme RAM Auslastung (April 2022)). There were cases of extreme RAM usage on Windows Server that went into overdrive, affecting operations. Blog reader Markus K. had informed me, but the problem was confirmed by other administrators. These problems were supposedly fixed by a signature update.

At the end of April 2022, I came across a new post from Markus K. on the patchmanagement.org mailing list, reporting massive problems on Windows 10 (20H2) and suspecting Windows Defender to be involved. From a black desktop after a user logs in that can last two minutes or longer, to Microsoft Word starting extremely slowly, to problems with Event Viewer or Diagnostic Performance Logs, it's all there. Markus wrote that only around 3 percent of his clients were affected. The details can be read in the blog post Defender for Endpoint verursacht Probleme bei Windows 10 20H2-Clients (26. April 2022).

A Reader has a new hint: FMAPOService

Since I publish blog posts in German and English, they are widely read. Blog reader Marco G. from France wrote that he came across my two blog posts Defender signatures cause extreme RAM usage (April 2022) and Defender for Endpoint causes issues with Windows 10 20H2 clients (April 26, 2022). He described his observation as:

Like many other administrators, we had issues starting in mid-April [2022]. We have found an explanation for these problems in [the above two] blog posts.

The problem persists and our users have to restart their computer every 2 hours.

We observed the memory leak and hoped that Microsoft would fix the problem in Defender….

We are trying to update the Intel video driver after reading the blog post Intel graphics driver (as of 27.20.100.8587) has memory leak – fix (as of 30.0.101.1191) available. But Windows Update restored the old driver, after restart …

But Marco could not see any improvements. Then the attempt to use an antivirus solution from a third party (they installed Avast on a computer). After that, the problems were gone. But Marco noticed that in his corporate environment, some computers (HP ProBook 430 G8) were affected more often than others.

He then proceeded to monitor these computers with the 'Performance Monitor'. He found out that the 'Handle Count' of 'FMAPOService' was higher than the accumulation of all processes of the computer.

The abbreviation FMAP probably stands for Fortemedia APO, and the 'Fortemedia APO Service' seems to be used by the Realtek sound drivers to generate audio effects (for Dolby support). When searching the Internet, the hit FMAPOService comes up more often in connection with suspected virus infections, as the service has probably caused load problems before.

Marco then wrote that systems upgraded to Windows 10 21H2 in April also installed the updated version of the Fortemedia component (26/04/2022). But that driver version, Marco said, doesn't seem to work very well with Windows Defender. Having reached this point of realization, he disabled the autostart of "FMAPOService" in all systems. That then solved his problems, he said. He provided me with this information in the hope that this might help other people. At this point my thanks to Marco G. – if anyone is affected, I would be interested in feedback if the tip helped.