Fix msmpeng.exe High CPU Usage: Step-by-Step

This guide walks you through the most effective ways to fix msmpeng.exe high CPU usage, a common issue on Windows 10 and 11 where the Windows Defender antivirus process consumes excessive processor resources, slowing down your PC. You’ll start with quick checks, then move to more advanced fixes like adjusting scan schedules and resetting the service, and finally, if needed, how to exclude specific files or folders from real-time scanning.

What You’ll Need

• Administrator access to your Windows PC
• A few minutes to follow the steps
• Optional: a third-party antivirus or antimalware tool for a second opinion scan

Step-by-Step

1. Restart your computer. This clears temporary glitches and stops any currently running scan. Often, a simple reboot resolves the issue if it was caused by a one-time scan or a hung process.
2. Check for pending Windows Updates. Go to Settings > Update & Security > Windows Update (Windows 10) or Settings > Windows Update (Windows 11) and click Check for updates. Install any pending updates and restart. Microsoft regularly releases performance fixes for Defender.
3. Run a full scan manually. Open Windows Security (search for it in the Start menu), go to Virus & threat protection, and click Scan options. Choose Full scan and run it. This ensures any actual threat is found and cleaned, which might be the root cause of the high CPU usage.
4. Schedule scans during idle time. If the high CPU usage happens during scheduled scans, change the scan time. In Windows Security, go to Virus & threat protection > Manage settings > Scan options (or Exclusions depending on your version), and look for Schedule a scan. Set it to a time when you’re not using the PC, like 2 AM.
5. Add exclusions for known heavy folders. If the high usage occurs when you access certain large folders (like a VM directory or a game folder), add them to exclusions. Go to Windows Security > Virus & threat protection > Manage settings > Exclusions. Click Add or remove exclusions, then add a folder, file, or file type. Be careful: only exclude folders you trust.
6. Reset Windows Defender. Open Command Prompt as Administrator (search for cmd, right-click, Run as administrator). Type the following and press Enter: sc stop WinDefend. Then type sc start WinDefend and press Enter. This restarts the service and can clear stuck states.
7. Use PowerShell to re-register Defender. In the same administrator Command Prompt or PowerShell, run: Set-MpPreference -ScanScheduleDay 0 to reset scan settings, or Update-MpSignature to force-update virus definitions. Then restart.
8. Check for conflicting third-party antivirus. If you have another antivirus installed, uninstall it completely using the vendor’s removal tool. Two real-time scanners can cause a loop of checks, spiking CPU usage.
9. Perform a clean boot. Type msconfig in the Start menu, go to the Services tab, check Hide all Microsoft services, then click Disable all. Restart. If CPU usage drops, a third-party service is interfering. Re-enable services one by one to find the culprit.
10. If all else fails, run the Windows Defender Offline scan. In Windows Security, go to Virus & threat protection > Scan options, and select Microsoft Defender Offline scan. This runs a scan outside of Windows and can remove deeply embedded malware that might be causing the high CPU.

Common Mistakes

• Disabling Windows Defender entirely. This leaves your system unprotected. Only do this temporarily and if you have another real-time antivirus active.
• Adding exclusions too broadly. Excluding your entire C: drive defeats the purpose of the antivirus. Only exclude specific, trusted folders.
• Ignoring the possibility of actual malware. High CPU from msmpeng.exe can be a sign that it’s actively fighting an infection. Always run a full scan before assuming it’s a bug.
• Not checking for other processes. Sometimes the culprit is another process that msmpeng.exe is scanning, not the Defender process itself. Check Task Manager to see which files it’s accessing.

Tips

• Keep Windows and Defender definitions up to date. This prevents many known bugs.
• Use the Performance Monitor to see exactly what msmpeng.exe is doing. Open Performance Monitor (type perfmon in Start), add a counter for Process > % Processor Time and select MsMpEng to see real-time usage.
• Consider using the built-in Troubleshooter. Go to Settings > Update & Security > Troubleshoot (Windows 10) or Settings > System > Troubleshoot (Windows 11), and run the Windows Update and System Maintenance troubleshooters.
• If you have an SSD, make sure TRIM is enabled. While not directly related, a healthy drive can reduce the time scans take.

Troubleshooting

If the above steps don’t reduce CPU usage, try these additional checks:

• Check the Windows Event Viewer. Look for errors related to Windows Defender or MsMpEng under Windows Logs > System. This can point to a specific driver or file causing the issue.
• Run System File Checker. Open Command Prompt as Administrator and run sfc /scannow. This repairs corrupted system files that might be affecting Defender.
• Use DISM tool. In the same admin Command Prompt, run DISM /Online /Cleanup-Image /RestoreHealth to fix Windows image issues.
• Check if the issue persists in Safe Mode. Boot into Safe Mode (Shift + Restart from the login screen). If CPU usage is normal there, a third-party driver or startup program is the cause.
• If you have recently installed new hardware or drivers, roll back those drivers. Sometimes a buggy driver can cause Defender to scan excessively.
• As a last resort, use the Media Creation Tool to perform an in-place upgrade repair. This reinstalls Windows while keeping your files and apps, and can fix deep system corruption.

Frequently Asked Questions

Why does msmpeng.exe use so much CPU?

It’s usually because Windows Defender is running a scheduled or real-time scan, or because it’s actively checking a large file or folder. Sometimes it’s a bug after an update, or it could be that your system is infected.

Is it safe to disable Windows Defender?

You can temporarily disable real-time protection, but you should not leave it off permanently unless you have another antivirus active. To disable temporarily, go to Windows Security > Virus & threat protection > Manage settings and turn off Real-time protection.

Can I add an exclusion for the entire Program Files folder?

You can, but it’s not recommended because that’s a common place for malware to hide. If you must, only exclude specific subfolders that you know are safe.

Will resetting Windows Defender delete my personal files?

No. Resetting the Defender service or re-registering it does not affect your personal files. It only resets the antivirus configuration.

How long does a full scan take?

It depends on your hard drive speed and the number of files. On a modern SSD, it can take 30 minutes to 2 hours. On an older HDD, it can take several hours. You can pause it if needed.

What if the high CPU usage happens only when I open a specific app?

That app might be triggering Defender to scan its files. Add that app’s folder to exclusions, or update the app to a newer version that is better optimized.

Related

• Avoid AM/PM Scheduling Errors in Calendar Apps
• How to Get Siri AI on iPhone, iPad, and Mac
• Clean PS5 Vents Safely: Step-by-Step Dust Removal