Antimalware Service Executable (MsMpEng.exe) is the background process that runs Microsoft Defender, and brief CPU spikes during scans or updates are normal. Persistent high usage is a symptom you can diagnose rather than a mystery: open Task Manager's Details tab to confirm MsMpEng.exe is the culprit, then briefly pause real-time protection to see whether CPU drops before testing further.
TL;DR:
- Confirm MsMpEng.exe in Task Manager’s Details tab, then briefly pause protection; it reactivates automatically, and a CPU drop points to Defender as the cause.
- For persistent spikes, use Defender Performance Analyzer, then ProcMon or a three to five minute Windows Performance Recorder trace to find repeatedly scanned items.
- Add an exclusion only after identifying a trusted file, folder, or process; exclusions affect real time scanning, so avoid broad paths such as entire drives.
- Defender’s AvgCPULoadFactor defaults to 50 on a scale of 5 to 100; lowering it can reduce CPU use but lengthens scans.
- Schedule scans for idle hours, keep security intelligence current, and run only one real time antivirus product to prevent overlapping scans and duplicate file checks.
Table of Contents
- What Antimalware Service Executable actually does
- Common causes of persistent high CPU from Antimalware Service Executable
- Quick, safe fixes to try now
- Diagnose precisely with Defender Performance Analyzer, ProcMon, and short traces
- Defender settings that control CPU and scan timing
- Advanced troubleshooting: clean boot, repair Security app, and when to escalate
- Day-to-day prevention: scheduling, updates, and trusted exclusions
- A performance specialist's workflow for MsMpEng.exe CPU spikes
- Tempered: diagnostics-led optimization for ongoing visibility
- FAQ
- Sources
- Key Microsoft docs and a readable explainer
What Antimalware Service Executable actually does
MsMpEng.exe handles three core jobs for Microsoft Defender: real-time protection that scans files as you open or download them, background and scheduled scans, and security intelligence updates. None of this runs silently in the background without occasionally touching your processor.
Normal behavior looks like short bursts of CPU use when you open a new file, install software, or copy a large folder. A full or manual scan uses noticeably more CPU for its duration, then settles back down. To confirm what you're seeing, open Task Manager, click the Details tab, and sort by CPU. If MsMpEng.exe sits at a high percentage for minutes at a time with no scan visibly running in the Windows Security app, that's worth investigating rather than ignoring.
Common causes of persistent high CPU from Antimalware Service Executable
A few patterns show up again and again when MsMpEng.exe won't settle down:
- Scheduled or manual full scans running alongside a security intelligence update, which can overlap and extend the high-CPU window, as Microsoft notes in its scan troubleshooting guidance.
- Repeated scanning loops triggered by specific files, large local databases, or obfuscated scripts that Defender keeps re-examining.
- Conflicts with another real-time security product running at the same time, which forces duplicate scanning of the same files.
- A Windows Security app error, where a blank or stuck interface leaves Defender scanning continuously without normal status reporting.
Microsoft's Performance Analyzer for Defender identifies the top paths, files, processes, and extensions driving scan overhead, which turns a vague "it's slow" complaint into a specific, fixable target, according to Microsoft Learn.
Quick, safe fixes to try now
Before changing any settings, confirm MsMpEng.exe is genuinely the process driving the spike in Task Manager's Details tab. Once confirmed, work through these steps in order:
- Open Windows Security, go to Virus & threat protection, and pause real-time protection temporarily to see if CPU usage drops; it re-enables automatically after a short period.
- If CPU drops noticeably, reschedule Defender's scans for idle hours through Task Scheduler or the scan options in Windows Security.
- Identify the specific file, folder, or process being repeatedly scanned, then add a narrow exclusion for just that target rather than a broad one.
- Retest and monitor Task Manager for a few hours to confirm the fix actually resolved the pattern instead of masking it temporarily.
Avoid disabling Defender permanently. Dual real-time antivirus products tend to create conflicts rather than solve them, and running with no active protection trades one problem for a bigger one.
Pro Tip: Exclusions apply only to real-time scanning, so keep them as specific as possible, a single file or folder path rather than an entire drive, to avoid leaving large blind spots.
Diagnose precisely with Defender Performance Analyzer, ProcMon, and short traces
When quick fixes don't hold, move to a measurement-first workflow instead of guessing at settings. Microsoft's own troubleshooting path for this is straightforward:
- Reproduce the spike, then start a recording with
New-MpPerformanceRecordingand review it withGet-MpPerformanceReportto see which files, paths, and processes are driving scan time, per Microsoft Learn's performance analyzer guide. - If the analyzer output is inconclusive, capture a Process Monitor (ProcMon) trace filtered to MsMpEng.exe for a few minutes while the spike is happening.
- For deeper kernel-level detail, run a 3 to 5 minute trace with Windows Performance Recorder (WPRUI) during the same reproduced spike.
- Feed whatever file, path, or process shows up repeatedly into a targeted exclusion with
Set-MpPreference, scoped to that exact item.
| Tool | Best used for | Output |
|---|---|---|
| Performance Analyzer | Identifying top scanned paths, files, processes, extensions | Performance report for exclusion decisions |
| Process Monitor (ProcMon) | Confirming repeated access to a specific file or folder | Filtered event log tied to MsMpEng.exe |
| Windows Performance Recorder (WPR) | Kernel-level detail when the analyzer is inconclusive | 3 to 5 minute system trace |
Microsoft's own Q&A guidance points out that repeated high CPU after a reset usually means Defender keeps scanning a specific workload, not that malware is present.
Defender settings that control CPU and scan timing
Several built-in settings govern how aggressively Defender uses your processor during scans:
AvgCPULoadFactorcaps average CPU use during a scan on a scale of 5 to 100, with a default of 50, according to Microsoft Learn.ScanOnlyIfIdleandEnableLowCpuPrioritylet scans wait for idle time or run at lower process priority, reducing impact while you're actively working.ThrottleForScheduledScanOnlyapplies throttling only to scheduled scans; manual scans can ignore these limits entirely, which matters when you're troubleshooting and wondering why a manual scan still spikes CPU.- Administrators set these through Group Policy, Intune, or PowerShell's
Get-MpPreferenceandSet-MpPreferencecmdlets.
Lowering AvgCPULoadFactor well below 50 reduces CPU load but extends how long each scan takes, since the throttle settings are guidance rather than a hard performance guarantee.
Advanced troubleshooting: clean boot, repair Security app, and when to escalate
When exclusions and scheduling don't resolve the issue, a few deeper steps help isolate the cause:
- Perform a clean boot through
msconfig, disabling third-party services and startup apps, to check whether another program is repeatedly triggering Defender scans. - Repair the Windows Security app with the SecurityHealthSetup tool if its interface is blank or unresponsive, since a broken UI can leave scans running without normal status updates.
- Collect a Performance Analyzer report and ProcMon trace covering the high-CPU window before contacting support, since this evidence speeds up diagnosis.
- Open a Microsoft support case once you have reproducible traces; running more ad hoc traces without a clear pattern rarely adds new information at that point.
Day-to-day prevention: scheduling, updates, and trusted exclusions
A few habits keep this from recurring:
- Schedule scans for off-hours or rely on
ScanOnlyIfIdleso Defender waits for genuine downtime. - Keep Windows and security intelligence updates current to avoid repeated post-update scans stacking on top of scheduled ones.
- Run only one real-time antivirus product at a time.
- Add narrow exclusions for known, trusted long-running workloads like local databases or virtual machine files.
For a broader look at diagnosing resource hogs beyond Defender, see our guide on how to find a CPU hog on Windows 11, and if Runtime Broker shows similar symptoms, our Runtime Broker high CPU piece covers that process specifically. Readers managing Defender across multiple machines may also find this guidance on Defender setup for managed environments useful.
A performance specialist's workflow for MsMpEng.exe CPU spikes
The discipline that actually works here is measure, reproduce, then target. Changing settings before you know what's driving the spike risks trading one performance problem for another, often a longer scan window instead of a shorter one. A transparent, reversible approach, where every change is visible and undoable, fits this process better than blanket tweaks. Reach for a diagnostic or monitoring tool first; save one-off changes for after you've confirmed the actual cause.
— Ian
Tempered: diagnostics-led optimization for ongoing visibility
We built Tempered around the same measure-first principle: it analyzes system performance data and turns it into plain-language recommendations instead of blind automatic tweaks. Every suggested change comes with a clear explanation and a way to undo it, so nothing happens without your approval.
- We surface background processes worth reviewing, Game Mode for active sessions, and startup adjustments, each with a visible undo path.
- Our free tier offers limited AI scans, with paid plans unlocking higher scan limits and premium features; current pricing details are on our pricing page.
If you want ongoing visibility into what's actually using your system's resources, not just during a Defender spike, try Tempered and see what it finds on your machine.
FAQ
Why does Antimalware Service Executable use so much CPU?
It usually reflects active work: a scheduled or manual scan, a security intelligence update, or repeated scanning of a specific file or folder that Defender keeps reexamining. Confirming the process in Task Manager and checking for overlapping scans, as described in Microsoft's troubleshooting guide, is the right first step.
How do I fix high CPU or memory use from the antimalware service executable?
Start by confirming MsMpEng.exe in Task Manager, then pause real-time protection briefly to test the effect before re-enabling it. If a scan is the cause, reschedule it for idle hours, and if a specific file or folder is repeatedly scanned, add a narrow exclusion for that item only.
How can I reduce CPU usage from other antivirus software?
Running more than one real-time antivirus product at once often causes both to scan the same files redundantly, which Microsoft's antivirus FAQ advises against. Checking that program's own throttling or scheduling settings, similar to Defender's AvgCPULoadFactor, usually resolves the overlap.
Why is 90% of my CPU being used?
A single process pinned near full CPU usually means an active scan, an update, or a repeated scan loop on a specific workload rather than a general system problem. Sorting Task Manager's Details tab by CPU identifies the exact process responsible, which is the starting point for any of the fixes above.
Sources
- What Is "Antimalware Service Executable" and Why Is It Running on My PC? — How-To Geek
- Troubleshoot Microsoft Defender Antivirus scan issues — Microsoft Learn
Key Microsoft docs and a readable explainer
For further reading, Microsoft's Performance Analyzer documentation and scan troubleshooting guide cover the official diagnostic workflow in detail. The Microsoft Q&A thread on high CPU usage and How-To Geek's explainer offer additional context in plainer language.