Forum Discussion
Improved Resource Management Control
Summary
Improved resource management control for plugins leveraging Windows Management Instrumentation (WMI) on Nessus Agent 11.1.0 or higher.
Impact
Customers with Nessus Agent 11.1.0 and later versions will have the ability to granularly control the CPU resources consumed during scans. This update ensures that plugins respect the resource usage setting selected during scan configuration by launching commands as children of the Nessus Agent, rather than invoking them via WMI. The release of these plugins will continue through January, with a phased approach over three weeks. The first release will be January 13th, the second January 20th, and the final planned plugin update on February 9th.
Target Release Date
Phase 1 plugin set: January 13, 2026
Phase 2 plugin set: January 20, 2026
Phase 3 plugin set: February 9, 2026
6 Replies
Do these changes mean that we will finally have a way to create exceptions in EDR products like Microsoft Defender for Endpoint? To this point it's been impossible to exclude an agent scan from the Defender Attack Surface Reduction rules like 'Block process creations originating from PSExec and WMI commands' because each process was independent. If the plugins are now child processes under nessud.exe or another executable in the Agent, we may have a solution! Am I understanding the new functionality correctly? It would be great to see some information in updated documentation to describe the process tree changes.
Hi paul_jacoby . You can find the agent release notes here.
Regarding your question about Microsoft Defender for Endpoint. I cannot comment on how that product works, but the changes made move command execution from under WMI to under the Nessus agent process tree for Nessus agent scans. There are no configuration options to change. There are still WMI queries executed that don't run commands, but spawning of processes like powershell.exe is now under the Nessus Agent's process tree.
Will the CPU utilization cap also apply to the continuous assessment functionality?
Did these plugin updates occur as scheduled and is there any further information available on how the changes were implemented? It would be very useful to understand how the processes run in this new design.
The plugins were released as scheduled. I provided some additional information in response to your previous question. Hopefully, that provides what you are looking for.
