About memory performance

Applies To: Forefront Client Security

Memory is a resource composed of both physical RAM and a paging file on the hard drive of the computer. A computer running a Microsoft Windows operating system uses a virtual memory addressing system to manage the finite resources of RAM and the paging file. Although a discussion of how operating systems use RAM, paging files, and virtual memory addressing to satisfy memory needs is beyond the scope of this document, you can find more information by searching for "virtual memory" and "paging file" in the Microsoft Knowledge Base.

Memory impact on a client system varies according to what Client Security components are doing. There are two possible states the Client Security agent software can be in: in a scan (active) and not in a scan (quiescent).

Component Approximate memory use when active (in KB) Approximate memory use when quiescent (in KB)

MOM agent



Antimalware service



Security State Assessment service



There are two types of scans that can be run on a managed computer: full and quick. The following table describes the approximate memory use of the Antimalware service during testing on computers running Windows Vista™ and Windows XP.

Table for antimalware engine memory

In the preceding table, private bytes is the amount of memory that a process has allocated, which cannot be shared with other processes. Virtual bytes is the current size of the virtual address space the process is using. Working set is the size of the set of memory pages used recently by the threads in the process. Taken together, these measures show you a profile of the memory use of the Antimalware service in a test environment.

The configuration of the test computers is summarized in the following table.

Operating system Processor RAM (in GB) Hard disk type Total hard drive space (in GB) Used hard disk space (in GB) Office version installed

Windows Vista

Xeon 2.8 GHz





Office 2007

Windows XP Service Pack 2 (SP2)

Xeon 2.8 GHz





Office 2003