What is 'MD Res Controller' - Windows Security

Question

I updated the Security Intelligence version of Windows Security today (1.409.82.0) and noticed something in the Event Viewer logs, in Applications and Services > Microsoft > Windows > Windows Defender > Operational

the normal update events occurred in this log, but they were accompanied by another event at the same time that displayed the HKLM Windows Defender registry pathway and said:

"Old Value: (registry path)\WindowsDefender\CoreService\MdDisableResController = 0x1

New Value: (registry path)\WindowsDefender\CoreService\MdDisableResController = 0x0"

this isn't the first time a Security Intelligence update seemingly changed the configuration of this MdDisableResController value. on the 7th of February, when updating to 1.403.3334.0, these events were among the regular update events;

"Old Value: Default\CoreService\MdDisableResController = 0x0

New Value: (registry path)\Windows Defender\CoreService\MdDisableResController = 0x1"

there are no updates about this MdDisableResController value before February 7th 2024, and none after, until today, which is April 7th for me. I thought the dates might have something to do with it, but my friend is also on Security Intelligence version 1.409.82.0 and there are no MdDisableResController, or WdConfigHash events in this log at the time of the update.

I didn't concern myself with the value last time because when he received the same update on February 7th, the MdDisableResController value changed from "Default 0x0" to a proper 0x1 entry

however, his still remains at 0x1 and mine is now 0x0. does anyone know what 0x1 and 0x0 would mean in the context of this key? and does anyone know what "Md Res Controller" actually is? I can't find any information from google searches, what is the "Res Controller"?

Windows 10 22H2

Answer 1

update; there have been 2 Security Intelligence updates today. the first changed absolutely nothing, but the second update (1.409.112.0) has once again changed the MdDisableResController from 0x1 back to 0x0, and changed the WdConfigHash from the previous value, back to the new one

once again, the changes also include a change to the "Windows Defender\Features\Controls\50" value. this time, the Old Value was nothing (it didn't exist), and now the New Value is "Controls\50 = 0x0". this is the only 0x0 value in the Controls section, everything else is 0x1

my laptop, and friend's computers, have also not experienced this, as mentioned yesterday. these changes only appear to happen when an actual Security Intelligence update occurs, so I feel like this might be nothing to worry about but I did both a MalwareBytes and Windows Defender scan; both of which came up clean

MalwareBytes does not run at the same time as Defender, I do not have RTP for MalwareBytes. important clarification, they wouldn't be clashing

Answer 2

after the update, when it changed from 0x1 to 0x0, nothing seemed different. Windows Defender was still functional

there was also an event at the time of the update, displaying a new WdConfigHash value, different from the old one (which was last changed on the 6th of March by another update). the WdConfigHash value updating on March 6th is also the same on my friend's system; however, it was not changed by the update today unlike mine

what's confusing to me is that these changes seemed to revert after the next Security Intelligence update

I checked for updates and Windows Defender updated to Security Intelligence version 1.409.86.0, and then checked the Windows Defender Operational logs

the same events were there, but this time, the value on the MdDisableResController was changed from 0x0, back to 0x1

the WdConfigHash value was also reverted back to the previous value, the one from the March 6th update

later, when updating again to Security Intelligence version 1.409.88.0, no further changes were made regarding these values. none of this occurred on my friend's system, but the values did only change when actually updating Windows Defender

it's just confusing to me that the next update after they were changed, seemingly reverted those changes back

Answer 3

Hello HamAndHands，

Welcome to the Microsoft Community！

Based on the information you shared, "MD Res Controller" may refer to some kind of resource controller in Windows Defender. Where MdDisableResController is a registry key whose value is changed from 0x1 to 0x0. Usually, 0 means disabled and 1 means enabled.

Therefore, when the value of the key changes from 0x1 to 0x0, it may mean that a feature or component changes from the disabled state to the enabled state. However, there is no documentation in the Microsoft repository related to the MD Res Controller that describes exactly which component or feature to enable or disable in Windows Defender.

During a Security Intelligence Update, Windows Defender may make adjustments to its internal components, including the Resource Controller, to improve security or performance. You can ignore these changes for now if they work, if you notice that you have some features that are not working, please get back to me.

I hope this answers your questions. Thank you for your patience and cooperation, your support and understanding is highly appreciated.

Best Regards ,

Morning | Microsoft Technical Support Community