[Windows][34.0.1] Periodic local file traversal triggers ~56k Microsoft Defender real-time scans in ~2 minutes

### ⚠️ Before submitting, please verify the following: ⚠️

- [x] This is a **bug**, not a question or a configuration issue.
- [x] This issue is **not** already reported on Github (I have searched for it).
- [x] Nextcloud Server and Desktop Client are **up to date**. See [Server Maintenance and Release Schedule](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule) and [Desktop Releases](https://nextcloud.com/install/#install-clients) for supported versions.
- [x] I agree to follow Nextcloud's [Code of Conduct](https://nextcloud.com/contribute/code-of-conduct/)

### Bug description

On Nextcloud Desktop Client 34.0.1 on Windows, the client periodically appears to traverse a large part of the local sync tree. These file accesses trigger tens of thousands of Microsoft Defender real-time scans in a very short period.

The user-visible symptom is a sudden increase in fan speed for approximately one minute, accompanied by significant CPU and disk activity from Microsoft Defender's `Antimalware Service Executable`. This happens intermittently, typically around every two hours, while the machine is otherwise idle or under comparable low-load conditions.

No application is manually started when this occurs.

A Microsoft Defender Performance Analyzer recording was captured during one occurrence. The recording shows that almost all Defender real-time scan activity during the capture was initiated by `nextcloud.exe`.

> **AI disclosure:** This issue report was drafted with the assistance of OpenAI ChatGPT. The interpretation and analysis of the Microsoft Defender Performance Analyzer results below were also generated with AI based on the machine-generated logs supplied by the reporter. The underlying measurements were produced by Microsoft Defender/Windows and were not generated or modified by AI. Conclusions derived from those measurements should therefore be treated as potentially flawed

#### Defender Performance Analyzer results

Recording interval:

- Start: 2026-08-11 19:32:45
- End: 2026-08-11 19:34:27
- Recording duration: approximately 102 seconds

Overview:

| Metric | Result |
| --- | ---: |
| Real-time scans | 56,742 |
| Cumulative real-time scan duration | 469,290.679 ms |
| Maximum individual scan duration | 1,687.214 ms |
| Median scan duration | 7.749 ms |
| Skipped scans | 227 |

Top process:

| Process | Scan count | Cumulative scan duration | Average | Maximum |
| --- | ---: | ---: | ---: | ---: |
| `C:\Program Files\Nextcloud\nextcloud.exe` | 56,202 | 466,877.604 ms | 8.307 ms | 1,687.214 ms |
| `C:\Windows\System32\mmc.exe` | 309 | 2,077.167 ms | 6.722 ms | 15.652 ms |

Thus, during this recording, approximately 99% of all Defender real-time scan events were associated with `nextcloud.exe`.

The scan entries are consistently reported as:

```text
ScanType: RealTimeScan
Reason: OnOpen
Process: nextcloud.exe
Path: D:\Nextcloud\...
```

The accesses are not limited to a particular file or file type. They span large numbers of files throughout the local Nextcloud tree.

Examples of extension counts during this single recording:

| Extension | Scan count |
| --- | ---: |
| `.JPG` | 23,524 |
| `.m4a` | 10,542 |
| `.jpg` | 8,619 |
| `.PNG` | 2,907 |
| `.mp3` | 2,270 |
| `.png` | 1,983 |
| `.mp4` | 1,111 |
| `.itc2` | 1,219 |
| `.heic` | 705 |
| `.HEIC` | 574 |
| `.MOV` | 554 |

There are also accesses to executables, PDFs and other file types.

This suggests that the Defender load is a secondary effect: `nextcloud.exe` opens a very large number of local files, and Defender subsequently scans those files through its normal real-time `OnOpen` protection.

No regular Defender quick/full scan was logged at the time of the captured occurrence. A separate Defender quick scan had taken place several hours earlier. Therefore, the observed event does not appear to be a scheduled Defender scan.

### Possibly related issue

This looks potentially related to:

https://github.com/nextcloud/desktop/issues/10491

That issue describes a regression in Desktop Client 34.0.0 where discovery repeatedly re-reads local directories even when they are unchanged. It was closed with milestone 34.0.1.

The current report is specifically for **34.0.1**, where a large number of local file opens can still be objectively observed through Microsoft Defender's performance tracing.

I cannot yet confirm that this is the exact same code path as #10491. No controlled downgrade comparison has yet been performed for this machine.

### Expected behavior
see below
### Actual behavior

Periodically, `nextcloud.exe` opens a very large number of files throughout the local synchronization tree.

Microsoft Defender consequently performs tens of thousands of `OnOpen` real-time scans. During the captured occurrence:

- 56,742 Defender real-time scans occurred in approximately 102 seconds.
- 56,202 of those were attributed to `nextcloud.exe`.
- The accesses covered photos, music, videos, application files and other unrelated parts of the synchronization tree.
- Microsoft Defender temporarily showed substantial CPU and disk activity.
- The laptop fan increased to an unusually high speed for approximately one minute.

The event then subsides and the system returns to normal until the next occurrence.

### Steps to reproduce

1. Run Nextcloud Desktop Client 34.0.1 on Windows with a local synchronized directory containing a large mixed file collection.
2. Leave Nextcloud running normally.
3. Do not manually start a sync or open large parts of the synchronized directory.
4. Wait for the periodic background activity to occur. On this system it happens intermittently, typically approximately every two hours.
5. Observe that Microsoft Defender's `Antimalware Service Executable` suddenly consumes significant CPU and disk resources and the laptop fan ramps up.
6. Capture the event using Microsoft Defender Performance Analyzer:

```powershell
New-MpPerformanceRecording -RecordTo "$env:USERPROFILE\Desktop\Defender.etl"
```

7. Stop the recording after the activity subsides and analyze it using:

```powershell
Get-MpPerformanceReport `
-Path "$env:USERPROFILE\Desktop\Defender.etl" `
-TopProcesses 20 `
-TopFiles 30 `
-TopExtensions 20 `
-TopScans 100 `
-Overview
```

8. The resulting report shows tens of thousands of `RealTimeScan / OnOpen` events caused by `nextcloud.exe` across the local synchronization tree.

### Expected behavior

When the synchronized data and server state are largely unchanged, the desktop client should not repeatedly open tens of thousands of local files during a short background cycle.

An idle or unchanged synchronization tree should not cause enough local file activity to trigger approximately 56,000 Microsoft Defender real-time scans within about two minutes.

The client should return to and remain in an idle state without periodically causing substantial CPU, disk and thermal load.

### Which files are affected by this bug

The behavior is not isolated to a specific file. Files throughout the local sync root are accessed The Defender recording shows tens of thousands of accesses covering JPG/JPEG, PNG, HEIC, M4A, MP3, MP4, MOV and other formats. The full Defender report contains personal filenames and paths and is therefore not attached publicly in unredacted form. A sanitized report or additional measurements can be provided if useful.

### Operating system

Windows

### Which version of the operating system you are running.

Windows 11

### Installation method

Official Windows MSI

### Nextcloud Server version

32.0.12.1 according to status.php

### Nextcloud Desktop Client version

34.0.1

### Did this occur after an update or on a clean installation?

Major version update (i.e. 4.0.0 → 33.0.0)

### Are you using the Nextcloud Server Encryption module?

Yes

### Are you using an external user-backend?

- [ ] Default internal user-backend
- [ ] LDAP or Active Directory
- [ ] SSO - SAML
- [ ] Other

### Nextcloud Server logs

```shell
No corresponding server-side error has yet been identified.

The observed workload is local: Microsoft Defender tracing shows `nextcloud.exe` opening large numbers of files under the local synchronization root.

Nextcloud Desktop debug logs covering the same occurrence have not yet been correlated with the Defender trace.
```

### Additional info

During a normal occurrence, Windows Task Manager showed `Antimalware Service Executable` at approximately 23% CPU usage and approximately 53.5 MB/s disk activity.

The Defender `Operational` event log did not contain a corresponding normal Defender scan-start event at the time of the occurrence. A separate quick scan had completed several hours earlier.

The Defender Performance Analyzer report also contained one performance hint that a particular executable in the synchronization tree was not trusted. This does not appear sufficient to explain the overall event because the captured activity consists of more than 56,000 scans across many unrelated media and data files.

Based on the trace, my current hypothesis is:

1. Nextcloud performs a broad local discovery/file traversal.
2. `nextcloud.exe` opens tens of thousands of files.
3. Microsoft Defender reacts normally to those opens with `RealTimeScan / OnOpen`.
4. Defender therefore becomes the visible CPU/disk consumer even though the initiating process is Nextcloud.

This hypothesis and the analysis above were generated with AI from the captured Defender data and are not intended as a definitive identification of the faulty Nextcloud code path.

Start with the Windows 11 reproduction described for Desktop Client 34.0.1 and use the supplied New-MpPerformanceRecording and Get-MpPerformanceReport PowerShell commands. Correlate the Defender trace with Nextcloud Desktop debug logs, which the report says have not yet been matched to the occurrence. Done means identifying the local traversal responsible and demonstrating that an unchanged sync tree no longer causes the reported repeated file access and scan load.

Written by the indexing model from the issue text.