Massive speed-up by adding 'busybox.exe' to Windows Security Exclusions

[stianhoiland]

I'm "cross-posting" this to here: rmyorston/busybox-w32#583

---

I think it would be a good idea to document and really push this configuration trick in the documentation. It has a dramatic effect on performance; so much that it should be considered a mandatory part of getting set up.

You can get to the Exclusions dialog by running explorer.exe windowsdefender://exclusions, or by clicking your way through
Start Menu -> search Windows Security -> Virus & threat protection -> Manage settings (under Virus & threat protection settings) -> Add or remove exclusions (under Exclusion, at the bottom)

Add 'busybox.exe' to Windows Security / Microsoft Defender Antivirus exclusions like so, and watch it fly:

[skeeto]

For years I’ve added C:\ as an exclusion, essentially disabling Defender. If you’re used to having it on, turning it off is so fast it feels like substantial desktop/laptop upgrade.

[Peter0x44]

Microsoft says the dev drive can improve perf further.
https://learn.microsoft.com/en-us/windows/dev-drive/

[skeeto]

dev drive

Ah, I've come across the name but didn't know what it was. I tried it and unfortunately cannot get it to work. The wizard UI is kind of terrible, and I would up with a new D:\ drive that was write protected while every tool reported it was not write protected. Nothing I tried fixed it, not even the stuff at the end of this article:

https://www.koskila.net/fix-refs-dev-drive-windows/

So it seems to me this is some half-baked, overly-complex feature that doesn't work reliably.

[Peter0x44]

I tried it out on my machine and it worked fine.

I screen recorded the process in case the flow is something other than what you did. That wizard flow is certainly... bizarre

Screen.Recording.2026-05-05.222557_compressed.webm

[Peter0x44]

you will also notice in the first few frames one of the most annoying tendencies of the windows start menu - autocomplete the desired thing, pressing enter, and then it changes its selection out in front of my eyes, before I get to press enter on it.

You can see another questionable choice by microsoft, a check box to let a user... KILL a process in task manager???
edit: I misunderstood but it's still weird

[skeeto]

Looks like that's Home edition? When I did it on Professional I followed the same steps, but it was ReFS by default, which I thought was the whole point of using a dev drive.

[Peter0x44]

No I have windows 11 pro.

[Peter0x44]

OK I got it formatted with Refs. I figured out why. I entered 30GB, when the minimum was 50GB to use refs. It won't let you select it for a smaller partition I think?

I can read and write it just fine.

[Peter0x44]

I did a benchmark. Run a from-scratch build of elfeed2 on the dev drive and not.

dev drive:
real    1m 32.31s
user    0m 0.01s
sys     0m 0.00s

not-dev drive:
real    1m 31.46s
user    0m 0.00s
sys     0m 0.01s

...so it made zero difference.

[stianhoiland]

For years I’ve added C:\ as an exclusion, essentially disabling Defender.

Okay, but adding only a single process image busybox.exe to the exclusions is a non-nuclear option that massively improves the experience of using w64devkit (and busybox-w32) and can be recommended generally, unlike completely disabling Windows Defender or using Dev Drive. I think this recommendation should be front and center; not having it configured this way should be considered a misconfiguration. Although we might not like it, this is how Microsoft has decided to architect and expose the configuration that aligns with w64devkit's intended usage.