Fix Antimalware Service Executable High CPU Usage

This guide walks you through the most effective ways to resolve the Antimalware Service Executable (MsMpEng.exe) consuming high CPU on Windows 10 and Windows 11. You’ll learn how to adjust Windows Defender’s settings, schedule scans, and apply fixes that reduce the performance impact without disabling your protection.

What You’ll Need

• Administrator access to your Windows PC
• Windows 10 or Windows 11 (the steps are nearly identical on both)
• About 15–20 minutes of time

Step-by-Step

1. Check if it’s actually the problem. Open Task Manager (Ctrl+Shift+Esc), go to the Processes tab, and look for “Antimalware Service Executable” under Windows Defender. If it’s using more than 30–40% CPU for an extended period (not just during a scan), proceed with the fixes below.
2. Run a quick scan manually. Sometimes the service gets stuck on a corrupted cache. Open Windows Security (search for it in the Start menu), go to Virus & threat protection, and click “Quick scan.” Let it finish, then restart your PC. This often clears the stuck state.
3. Exclude files and folders that are known to cause high CPU. Go to Windows Security → Virus & threat protection → “Manage settings” under Virus & threat protection settings. Scroll to “Exclusions” and click “Add or remove exclusions.” Add the following if they exist on your system:
   • Your user profile folder (e.g., C:\Users\YourName) – but only if you trust the files there
   • Your browser’s cache folder (e.g., C:\Users\YourName\AppData\Local\Google\Chrome\User Data\Default\Cache)
   • Large game installation folders (e.g., Steam, Epic Games)
   • Virtual machine files (.vhd, .vhdx, .vmdk) if you run VMs

   Be careful – only exclude locations you trust. Excluding your entire system drive is not recommended.

4. Reduce the scan load. Windows Defender scans every file on access. To lower CPU usage:
   • Go to Windows Security → Virus & threat protection → “Manage settings” → “Real-time protection” – turn it off and on again (this resets a stuck process).
   • Under “Exclusions,” add file extensions that are safe and large, like .iso, .vhd, .zip (if you don’t need them scanned on access).
5. Schedule scans during idle time. Open Task Scheduler (search for it), navigate to Task Scheduler Library → Microsoft → Windows → Windows Defender. Right-click “Windows Defender Scheduled Scan” and select Properties. Go to the “Conditions” tab and check “Start the task only if the computer is idle for” – set it to 30 minutes. Also, uncheck “Wake the computer to run this task.” This prevents scans from running while you’re actively working.
6. Use PowerShell to set a low priority for the service (advanced). Open PowerShell as Administrator and run:

   Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name "ScanPriority" -Value 1

   This lowers the scan’s CPU priority. Restart your PC. (If you’re not comfortable with the registry, skip this step.)

7. Update Windows and Defender definitions. Go to Settings → Windows Update and install all pending updates. Then go to Windows Security → Virus & threat protection → “Protection updates” → “Check for updates.” Outdated definitions can cause the service to work harder.
8. Check for conflicting third-party antivirus. If you have another antivirus installed (like Malwarebytes or Avast), it may conflict with Defender. Uninstall the third-party one or disable its real-time protection, then restart and see if CPU drops.
9. Run the Windows Defender Offline scan. If the high CPU persists, it could be malware. Go to Windows Security → Virus & threat protection → “Scan options” → “Microsoft Defender Offline scan” → “Scan now.” Your PC will restart and run a deep scan. This can take an hour.
10. Reset Windows Defender components. As a last resort, open PowerShell as Administrator and run:

    Set-MpPreference -DisableRealtimeMonitoring $true
    Set-MpPreference -DisableRealtimeMonitoring $false

    This toggles real-time protection off and on, which often resets a stuck service. Restart your PC.

Common Mistakes

• Disabling Windows Defender entirely. This removes your protection and can cause Windows to show a warning. It’s not a fix – it’s a security risk.
• Adding too many exclusions. Excluding large parts of your system (like the entire C: drive) can let malware run unchecked. Only exclude specific, trusted folders.
• Ignoring the scan schedule. If you don’t adjust the schedule, Defender will run scans at random times, causing CPU spikes.
• Assuming it’s always a bug. Sometimes high CPU is because a scan is running. Check Task Manager to see if a scan is active before making changes.

Tips

• Keep your Windows and Defender definitions up to date – this prevents many issues.
• Use a solid-state drive (SSD) if you can; Defender runs faster on SSDs, reducing CPU load.
• If you have an older PC, consider upgrading RAM – low memory can force Defender to work harder.
• Monitor CPU usage in Task Manager after each step to see what works.
• If you’re a gamer, add your game folders to exclusions – this is a common fix for stutter during gameplay.

Troubleshooting

If the high CPU usage continues after trying the steps above:

• Check for malware. Run the Offline scan (step 8). Malware can sometimes hide inside Defender’s own processes.
• Check for corrupted system files. Open Command Prompt as Administrator and run sfc /scannow. If it finds issues, restart and run it again.
• Check the Windows Event Viewer. Search for “Event Viewer,” go to Windows Logs → System, and look for errors related to “Windows Defender” or “MsMpEng.” This can give clues.
• Try a clean boot. Press Win+R, type msconfig, go to the Services tab, check “Hide all Microsoft services,” click “Disable all,” then restart. If CPU drops, a third-party service is causing the conflict. Re-enable services one by one to find the culprit.
• If nothing works, consider a system restore. Go to Settings → System → Recovery → “Open System Restore” and pick a point before the issue started.

Frequently Asked Questions

Is it safe to disable Windows Defender?

No. Disabling it leaves your PC unprotected. The steps above are meant to reduce its CPU usage while keeping it active. If you must disable it temporarily, re-enable it as soon as possible.

Why does Antimalware Service Executable use so much CPU?

It’s Windows Defender’s real-time protection scanning every file that’s opened or changed. High CPU usually happens during scans, when definitions are outdated, or when there’s a conflict with another security program.

Will adding exclusions reduce my security?

Only if you exclude locations that could contain malware. Excluding a trusted folder like your Steam games library is low risk. Excluding system folders like C:\Windows is not recommended.

How often should I run a full scan?

Once a week is a good balance. The default schedule is usually fine, but you can adjust it in Task Scheduler to run when you’re not using the PC.

Does this issue affect Windows 11 differently?

No, the behavior is the same. The steps in this guide work on both Windows 10 and 11.

Can I set a CPU usage limit for Defender?

Not directly. But you can lower its priority via PowerShell (step 6) and schedule scans for idle times. That effectively reduces its impact on your work.

Related

• Credit Score vs Credit Limit: Key Differences
• iMessage Unknown Error: Fixes That Work
• Fix Settings App Not Opening in Windows 11