Windows issue: Defender collides with FMAPOService

Windows[German]In April 2022, I had reported issues with Windows Defender on Windows 10 (20H2). From extreme RAM usage to startup problems with Word or effects like black screen after user login has been observed/reported. Some issues were supposedly fixed by a Defender signature update, but users continue to have issues. Now an administrator from France contacted me by mail. Based on my blog posts, he was able to trace the problem back to a collision between Defender and FMAPOService.


Advertising

Trouble with Defender

In April 2022  I had reported about problems with Windows Defender under Windows (see Defender Signaturen verursachen extreme RAM Auslastung (April 2022)). There were cases of extreme RAM usage on Windows Server that went into overdrive, affecting operations. Blog reader Markus K. had informed me, but the problem was confirmed by other administrators. These problems were supposedly fixed by a signature update.

At the end of April 2022, I came across a new post from Markus K. on the patchmanagement.org mailing list, reporting massive problems on Windows 10 (20H2) and suspecting Windows Defender to be involved. From a black desktop after a user logs in that can last two minutes or longer, to Microsoft Word starting extremely slowly, to problems with Event Viewer or Diagnostic Performance Logs, it's all there. Markus wrote that only around 3 percent of his clients were affected. The details can be read in the blog post Defender for Endpoint verursacht Probleme bei Windows 10 20H2-Clients (26. April 2022).

A Reader has a new hint: FMAPOService

Since I publish blog posts in German and English, they are widely read. Blog reader Marco G. from France wrote that he came across my two blog posts Defender signatures cause extreme RAM usage (April 2022) and Defender for Endpoint causes issues with Windows 10 20H2 clients (April 26, 2022). He described his observation as:

Like many other administrators, we had issues starting in mid-April [2022]. We have found an explanation for these problems in [the above two] blog posts.

The problem persists and our users have to restart their computer every 2 hours.

We observed the memory leak and hoped that Microsoft would fix the problem in Defender….

We are trying to update the Intel video driver after reading the blog post Intel graphics driver (as of 27.20.100.8587) has memory leak – fix (as of 30.0.101.1191) available. But Windows Update restored the old driver, after restart …

But Marco could not see any improvements. Then the attempt to use an antivirus solution from a third party (they installed Avast on a computer). After that, the problems were gone. But Marco noticed that in his corporate environment, some computers (HP ProBook 430 G8) were affected more often than others.

He then proceeded to monitor these computers with the 'Performance Monitor'. He found out that the 'Handle Count' of 'FMAPOService' was higher than the accumulation of all processes of the computer.


Advertising

The abbreviation FMAP probably stands for Fortemedia APO, and the 'Fortemedia APO Service' seems to be used by the Realtek sound drivers to generate audio effects (for Dolby support). When searching the Internet, the hit FMAPOService comes up more often in connection with suspected virus infections, as the service has probably caused load problems before.

Marco then wrote that systems upgraded to Windows 10 21H2 in April also installed the updated version of the Fortemedia component (26/04/2022). But that driver version, Marco said, doesn't seem to work very well with Windows Defender. Having reached this point of realization, he disabled the autostart of "FMAPOService" in all systems. That then solved his problems, he said. He provided me with this information in the hope that this might help other people. At this point my thanks to Marco G. – if anyone is affected, I would be interested in feedback if the tip helped.


Cookies helps to fund this blog: Cookie settings
Advertising


This entry was posted in Security, Windows and tagged , , . Bookmark the permalink.

5 Responses to Windows issue: Defender collides with FMAPOService

  1. EP says:

    the Fortemedia APO & FMAPO service files are found in certain Realtek audio drivers provided by either Lenovo or HP

    ask Marco G if he is using a computer made by Lenovo or HP and contact either one of those PC manufacturers for updated Realtek audio drivers that have updated FMAPO files that might resolve the problem

  2. Marco G says:

    Hello, the update was installed by WindowsUpdate as a separate component: it's more recent than the version include in the HP package.
    https://www.catalog.update.microsoft.com/Search.aspx?q=fortemedia

  3. TB says:

    Disabling the "FMAPOService" has helped in our clients issue where HP Probook 450 G8 machines were affected by it. The service caused a memory leak, which after few hours would rander the laptop unresponsive. Only the Windows 11 machines are affected though.

  4. Advertising

  5. GS says:

    We have been facing the same issue on a couple of devices (HP Probook 450 G8) and after disabling the FMAPOService we saw a drop in memory usage from 7GB to only 4GB in use out of the 8GB in total. In our case most devices were on Windows 10 (21h2).

  6. dfuchs2512 says:

    We had the same issue with our Lenovo P51s notebooks. The RAM usage increased until the machine got stuck after 3-4 hours of usage. Disabling the FMAPOService solved the issue. It seem like a memory leak in the service. Thanks to Marco G for digging into this so deep. Beside you was not able to see any service using all the memory. That was making it hard to discover a solution.

Leave a Reply

Your email address will not be published.