Solidworks performance problem when running interceptX

Question

Hi All, 
 Since a few weeks we have the Sophos Endpoint Protection with Intercept X running on all our clients. As a sysadmin im very happy with it so far. Sophos gives me a lot of control and gives me a great peace of mind of being protected. 
 Some of my users tho are not happy at all. They use the SolidWorks software and since the install of Sophos they complain about massive performance problems. And they are not lying. We been able to make some measurements with Sophos being turned off and turned on and the difference is like day an night. Since we've been investigating and trying to make things better by excluding the Solidworks processes, files (network and local), temp writing locations, install locations, etc... nothing seems to improve the performance. The only thing that is helping the performance is by disabling the thread protection option. But of course that is the one thing I don't want to do. 
 Now, I can't imagine im the only one to encounter these problems. Did any of you had this experience as well? 
 
 Kind regards, 
 Jeffrey

RichardP · Answer

Okay, so that leads me to think its the CryptoGuard feature. 
 CAD programs tend to be super memory intensive (from all those nice little vectors) and mitigate that with using swapping temp files. At least AutoCAD does and I remember, back when I was a drafter, that the disk IO would go through the roof when changing some vertices. 
 This could be the bottleneck. CryptoGuard tracks every file change (mostly writes) to see if: 
 
 Its a file CG cares about 
 the write might be malicious encryption 
 
 CG also tries to keep a backup of the file incase it needs to restore it. 
 Try creating a policy with CG disabled and test on a couple machines. If the performance improves, we can craft a thumbprint exclusion for the program.