Fix “Antimalware Service Executable” High CPU Usage Safely

Antimalware Service Executable (`MsMpEng.exe`) is Microsoft Defender’s scanning process. High CPU usage is normal for a short time during a scan or malware-definition update, but sustained usage can usually be reduced by updating Windows and Defender, restarting, scheduling scans for idle time, removing conflicting antivirus software, or investigating malware and Defender errors. Do not end the process or permanently disable Defender as a first fix; that removes protection without addressing the cause.

Is Antimalware Service Executable actually the reason your PC is slow?

First confirm that MsMpEng.exe is responsible rather than another process consuming CPU, disk, or memory.

Antimalware Service Executable (MsMpEng.exe) is using a large amount of CPU

1. Press Ctrl+Shift+Esc to open Task Manager.
2. Select the Processes tab and click the CPU column to sort by current usage.
3. Find Antimalware Service Executable. Select it, then choose Open file location if you want to verify the executable.

The legitimate Defender process is normally located under a Microsoft Windows Defender folder within C:\ProgramData or C:\Program Files\Windows Defender. A similarly named process in an unrelated folder needs investigation; do not add it to an exclusion.

4. Open Windows Security from the Start menu.
5. Select Virus & threat protection and check the protection status, Current threats, Protection updates, and any scan status shown on the page.

If CPU usage drops after a few minutes and Windows Security shows a scan or update in progress, the spike is probably temporary. If the process stays near the top of Task Manager during normal work and after the computer has been idle, continue with the fixes below. Also check the Disk and Memory columns: a storage bottleneck or low memory can make the whole PC feel slow even when Defender is not the main cause.

When high CPU usage is normal—and when it points to a problem

Microsoft Defender uses real-time protection to inspect files, programs, downloads, and other activity as you use Windows. It also runs scheduled quick or full scans and checks newly downloaded malware definitions. A first scan after a major definition or Windows update can take longer because Defender has new content to process.

A short period of CPU activity is normal when it matches a scan or update and then falls back. Scanning can also become more noticeable while you open a large archive, build software, copy many files, or start an application with many dependencies.

Persistent usage is more concerning when it continues through ordinary work and an idle period, causes repeated stuttering or fan noise, raises temperatures, or returns after every restart. Repeated scans can result from a damaged update, files that constantly change, a large folder being inspected repeatedly, malware activity, or another antivirus product interfering with Defender.

Before changing anything, check whether Windows Security says Scan in progress, whether a threat appears under Current threats, and whether Protection updates says that signatures need updating. These checks are safe and require no Administrator privileges.

This guidance applies to Microsoft Defender Antivirus on supported Windows 10 and Windows 11 installations. Menu names vary slightly by Windows version. Save open work before restarting. A backup is not normally needed for these initial checks, but keep backups current before repair operations later.

What to do first without turning off Microsoft Defender

Use these fixes in order. The initial checks and Settings changes generally require no Administrator privileges, although Windows can request elevation for some maintenance actions.

1. If Windows Security shows an active scan and you are not seeing signs of malware, let it finish while the computer is idle. Do not repeatedly stop and restart scans; that can extend the period of high usage.

Expected result: CPU usage falls after the scan completes.

If that does not happen: Continue with the next step and check for updates or scan errors.

2. Install Windows updates. Open Settings > Windows Update on Windows 11, or Settings > Update & Security > Windows Update on Windows 10. Select Check for updates, install available updates, and restart when prompted.

Settings > Windows Update > Check for updates

Expected result: Windows installs available updates and completes any requested restart.

If that does not happen: Restart Windows and try again before troubleshooting the update service itself.

3. Update Defender’s malware definitions. Open Windows Security > Virus & threat protection > Protection updates, then select Check for updates.

Windows Security > Virus & threat protection > Protection updates > Check for updates

A successful update should show a recent security intelligence version and update time.

If that does not happen: Restart Windows and try the update again. If it still fails, review Defender’s operational log in Event Viewer rather than disabling protection.

4. Restart the computer. A restart clears a stuck scan, completes pending Defender updates, and reloads security services. After signing in, leave the computer idle for a while before judging CPU usage.

Expected result: A completed scan or update does not immediately resume at high CPU usage.

If that does not happen: Continue with the antivirus and malware checks below.

5. Check for another antivirus product under Settings > Apps > Installed apps or Apps & features. Running two real-time antivirus products can create duplicate scanning and contention. Keep the product you intentionally chose, and uninstall the other through its normal uninstaller. Do not remove Microsoft Defender merely because it is visible; on current Windows versions it is normally the built-in protection that remains active when no third-party antivirus is registered.

Expected result: Only the antivirus product you chose provides real-time protection.

If that does not happen: Restart after uninstalling the conflicting product and confirm the protection status in Windows Security.

6. If you suspect malware, use Windows Security > Virus & threat protection > Scan options. Run a Full scan when Windows is usable, or choose Microsoft Defender Offline scan when a threat may be hiding while Windows is running. Save work first because the offline scan restarts the computer.

Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan

Expected result: The scan completes with no active threats and CPU usage falls afterward.

If that does not happen: If a threat is detected, follow Windows Security’s removal or quarantine action, restart if requested, and scan again. If Defender cannot update, the scan never completes, or CPU usage returns immediately, move to log review rather than disabling protection.

How to verify that CPU usage is back to normal

Retest under the conditions that caused the slowdown. Use the computer normally for several minutes, then leave it idle long enough for routine background work to settle. Task Manager should show Antimalware Service Executable using little CPU most of the time, although short increases can occur when files are opened or a scheduled scan runs. There is no single CPU percentage that defines a fault; the useful distinction is a brief burst versus persistent impact.

Open Windows Security > Virus & threat protection and confirm that real-time protection is on, no action is required, and no threat is waiting under Current threats. Review Protection history for detections, blocked applications, or repeated remediation attempts.

Windows Security > Virus & threat protection > Protection history

For more detail, open Event Viewer as an Administrator and inspect Defender’s operational log.

1. Press Win+R, type eventvwr.msc, and press Enter.
2. Expand Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational.
3. Look at entries created when the CPU spike occurred. Repeated scan starts, update failures, detections, or service errors are more useful than a single ordinary scan event.

Event Viewer > Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational

If the log shows repeated errors or scans with no clear end, record the event details and timestamps. Also check C:\ProgramData\Microsoft\Windows Defender\Support for Defender support logs; access may require Administrator approval. Persistent faults after updates and restarts justify running Windows repair tools or contacting Microsoft Support or a qualified technician.

How to prevent recurring Defender CPU spikes

Keep Windows and Defender definitions updated so scans and protection components do not remain in a failed or outdated state. If scans repeatedly start while you are working, schedule them for a time when the computer is normally idle through Task Scheduler.

1. Open Start, search for Task Scheduler, and run it as an Administrator.
2. Browse to Task Scheduler Library > Microsoft > Windows > Windows Defender.
3. Review the Defender scheduled tasks and their triggers. Adjust a scan’s schedule only when you understand which task you are changing, and choose an idle period rather than disabling the task.

Task Scheduler > Task Scheduler Library > Microsoft > Windows > Windows Defender

Expected result: Scans run during an idle period instead of repeatedly interrupting normal work.

If that does not happen: Check Defender’s operational log for repeated scan starts, update failures, or service errors before changing exclusions.

Large, constantly changing folders such as build output, dependency caches, virtual-machine disks, and media libraries can cause repeated inspection. Keep those folders tidy and remove stale files rather than excluding an entire drive. An exclusion is justified only for a specific, trusted folder or file that you understand and that is causing a documented conflict.

To add a narrow exclusion, open Windows Security > Virus & threat protection > Manage settings > Exclusions > Add or remove exclusions. Administrator approval is required. Select the smallest folder or file scope possible. Never exclude Downloads, temporary folders, the whole user profile, or a system drive, and remove the exclusion when the conflict ends.

Windows Security > Virus & threat protection > Manage settings > Exclusions > Add or remove exclusions

Expected result: The documented conflict stops without excluding unrelated files.

If that does not happen: Remove the exclusion and investigate the application, malware status, and Defender logs instead.

If CPU usage remains high with current updates, no conflicting antivirus, clean scans, and no justified exclusion, repair Windows rather than weakening protection. Back up important files first, then use Settings > System > Recovery on Windows 11 or Settings > Update & Security > Recovery on Windows 10 to review repair and reset options. Preserve personal files when possible, and get professional help before a reset if the Defender logs show corruption, repeated detections, or broader system instability.

Conclusion

Let a legitimate scan finish, then update Windows and Defender and restart. If usage persists, remove conflicting antivirus software, run a full or offline scan, and review Defender’s operational log. Repair Windows or seek support when the logs show repeated errors or scans that never finish; keep Defender enabled and use exclusions only for a narrow, trusted exception.

Frequently Asked Questions

Can I end Antimalware Service Executable in Task Manager?

Do not use this as a fix. Windows may restart the service, and ending it removes or weakens active scanning without addressing the cause. Use updates, a restart, scan scheduling, or log review instead.

Is it safe to disable Microsoft Defender permanently?

No. Permanently disabling real-time protection leaves Windows exposed and can cause Windows Security warnings. If you install a reputable third-party antivirus, allow Windows to register that product rather than manually disabling security services.

Why does Defender scan the same folder repeatedly?

Common causes include files that change constantly, scheduled scans, a failed update, malware activity, or software that conflicts with real-time protection. Check Defender history and the operational log before considering a narrowly scoped exclusion.