Antimalware Service Executable Fix for High CPU Usage
Windows 10 and Windows 11 run quite a few services in the background. These services normally do not take priority when it comes to using system resources. User processes are generally given priority. However, if you are experiencing antimalware service executable high cpu usage from MsMpEng.exe consistently, you may need to look into it and possibly fix a problem or two. In some cases, upgrading to the best AMD CPU for gaming can help balance performance and improve multitasking efficiency.
Antimalware Service Executable (MsMpEng)
The Antimalware Service Executable (MsMpEng.exe) is the Microsoft Defender Antivirus engine — the core process behind Windows Security. It is going to run all the time so if you see it in Task Manager, it’s nothing to worry about. The worrying thing is if it’s consistently using a lot of the CPU’s power. If your system is idle, the CPU usage will go up since Microsoft Defender utilizes the downtime to run scans, but you should not be seeing consistent antimalware service executable high cpu usage from this process.
Why Is Antimalware Service Executable Using High CPU or Disk?
Before changing any settings, it helps to know whether what you’re seeing is normal behavior or a genuine problem. Here’s a quick way to tell the difference.
Normal behavior (nothing to fix):
- Brief CPU or disk spikes during Windows startup
- Elevated usage while Microsoft Defender downloads definition updates
- High activity during a scheduled or manually triggered full scan that finishes within a reasonable time
Abnormal behavior (worth investigating):
- Sustained high CPU usage lasting 10–15 minutes or more with no scan in progress
- Repeated spikes every time you log in, even after a fresh restart
- 100% disk usage on a traditional HDD system that doesn’t resolve on its own
Common causes:
- Scheduled or full scans — Defender running a scan you haven’t noticed
- Real-time scanning of high-change files — folders with frequent writes (build output, VM images, game launchers) trigger repeated scans
- Defender definition updates — downloading and applying new virus definitions temporarily spikes CPU and disk
- Third-party antivirus conflicts or leftover components — remnants of an uninstalled AV tool can cause Defender to behave erratically
- Corrupted definitions or system files — damaged Defender data can cause runaway scanning loops
- Slow HDDs — even normal Defender activity can saturate an older spinning drive
- Actual malware — a stubborn infection can force Defender into constant scanning mode
Quick triage step: Open Task Manager (Ctrl + Shift + Esc), click the Processes tab, and sort by CPU or Disk. Confirm MsMpEng.exe is the real bottleneck causing antimalware service executable high cpu usage.
For a deeper look, open Resource Monitor (search for it in the Start menu), go to the Disk tab, and check which files MsMpEng.exe is reading or writing — this often reveals exactly what it is scanning so you can address the root cause.
FIX: Antimalware Service Executable High CPU Usage (MsMpEng)
1. Restart the System to Resolve Antimalware Service Executable High CPU
Desktop computers don’t need to be shut down every night. Most do fine by going into a low-power state. This is fine until processes begin to stall. This can happen on both Windows 10 and Windows 11. Try restarting your system and see if usage by this process returns to normal (single digits, or low double digits). Similar to antimalware service executable high cpu issues, other Windows processes can also cause performance problems, so if you continue experiencing high CPU usage from different services, you may also want to resolve CTF loader CPU problems.
2. Run a full scan
The antimalware service executable high cpu usage may be caused by a long-overdue scan that needs to run. Often, the simple solution is to allow a full scan to complete. You will need to stop the service in its current state and then initiate a fresh scan. It is best not to use your system until the scan completes so that it finishes faster. If your PC still feels sluggish afterward, you can also fix slow computer problems caused by other bottlenecks.
- Open Windows Security.
- Go to Virus & Threat Protection.
- Click Manage Settings under Virus & threat protection settings.
- Turn off all the switches.
- Restart the system.
- Once you’re back on your desktop, turn all the Virus & threat protection settings back on.
- Return to the main Virus & threat protection tab.
- Click ‘Scan Options’.
- Select ‘Full scan’ and click the ‘Scan now’ button.
- Allow the scan to complete.
3. Reset Windows firewall
Windows firewall has certain rules that users can modify according to their needs. As you install apps, you will often have to allow some exceptions for the firewall. VLC player is one common example of an app that asks for exceptions. While generally harmless, these rules may interfere with Windows Defender, and resetting the rules may fix the problem.
- Open Windows Security.
- Go to the Firewall and network protection tab.
- Scroll down, and click Restore firewalls to defaults.
- Restart the system, and antimalware service executable high cpu usage should return to normal. You can add your exceptions back to the firewall later on.
4. Scan for malware
Windows Defender is not impervious. It can stop malicious files and apps from running but it isn’t going to be able to stop everything. It’s possible that your system is infected with something that is causing Windows Defender to work in overdrive, which in turn drives antimalware service executable high cpu usage even higher. Try using a different scanning tool like the free version of MalwareBytes. It may disable Windows Defender while it runs but that isn’t something to worry about. Allow it to scan your system and remove any infected files. You can keep MalwareBytes or you can go back to Windows Defender.
5. Exclude Antimalware Service Executable from Windows Defender
Sometimes the antimalware service executable high cpu problem occurs because Microsoft Defender is repeatedly scanning its own engine process or a folder that changes files at a high rate. You can add exclusions to tell Defender to skip specific processes or folders it doesn’t need to scan. Here’s how to do it correctly.
To open the exclusions settings:
- Open Windows Security.
- Go to Virus & threat protection.
- Under Virus & threat protection settings, click Manage settings.
- Scroll down to Exclusions and click Add or remove exclusions.
- Click Add an exclusion.
From here you have two options depending on your situation:
Option A — Exclude the MsMpEng.exe process (troubleshooting step):
- Select Process from the exclusion type dropdown.
- Type MsMpEng.exe and click Add.
- Restart the system and check whether CPU usage has returned to normal.
Option B — Exclude specific high-I/O folders or applications (preferred approach):
If you know which folders are triggering repeated scans — for example, a software build output folder, a virtual machine image directory, a large game launcher folder, or a folder full of large archives — excluding those locations is a more targeted fix that causes less of a reduction in your overall protection.
- Select Folder from the exclusion type dropdown.
- Browse to and select the folder you want to exclude, then click Select Folder.
- Repeat for any other high-I/O locations you have identified.
- Restart the system.
Important: Exclusions tell Microsoft Defender to stop scanning those items entirely. Only exclude processes or folders you are certain are safe. Keeping the exclusion list short and specific is the best way to balance performance and protection.
6. Change Microsoft Defender scan schedule
If antimalware service executable high cpu spikes keep occurring at inconvenient times, you can reschedule Defender’s automatic scans so they only run when the PC is idle or during off-hours. You do this through Task Scheduler.
- Press Windows + R, type taskschd.msc, and press Enter to open Task Scheduler as an administrator.
- In the left panel, expand Task Scheduler Library > Microsoft > Windows > Windows Defender.
- Double-click Windows Defender Scheduled Scan.
- Click the Conditions tab.
- Check Start the task only if the computer is idle for and set a value such as 10 minutes.
- Also check Stop if the computer ceases to be idle so the scan pauses the moment you start using the PC again.
- Optionally, click the Triggers tab, edit the existing trigger or add a new one, and set it to run Weekly at an off-hours time such as 2:00 AM.
- Click OK to save your changes.
While you’re in the Windows Defender folder inside Task Scheduler, you will also see three related tasks: Windows Defender Cache Maintenance, Windows Defender Cleanup, and Windows Defender Verification. These are responsible for recurring Defender housekeeping. You can apply the same idle-only condition to any of them if you want to keep all Defender background activity confined to times when you aren’t actively using the PC.
Limit how much CPU Defender uses during scans
Rescheduling scans controls when they run, but you can also cap how much CPU Microsoft Defender is allowed to use while a scan is in progress. This is a practical middle ground for readers who want to keep Defender fully enabled but still reduce the impact on performance during active scanning periods.
Windows Pro or Enterprise — Group Policy Editor:
- Press Windows + R, type gpedit.msc, and press Enter.
- Navigate to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Scan.
- Double-click Specify the maximum percentage of CPU utilization during a scan.
- Set the policy to Enabled and enter a starting value of 20 or 30 (this represents a percentage of total CPU capacity).
- Click OK and restart the system.
Windows Home or any edition — PowerShell:
- Right-click the Start button and select Windows PowerShell (Admin) or Terminal (Admin).
- Run the following command: Set-MpPreference -ScanAvgCPULoadFactor 20
- To verify the setting was applied correctly, run: Get-MpPreference and look for ScanAvgCPULoadFactor in the output. It should show the value you entered.
Important: This setting limits CPU usage during scheduled and manual scans only. It will not eliminate brief CPU spikes caused by real-time protection, which responds to file activity as it happens and cannot be throttled in the same way.
7. Perform a clean boot to find software conflicts
The causes section above identifies third-party antivirus conflicts as a potential source of antimalware service executable high cpu usage, but knowing a conflict might exist is only half the picture — you also need a way to prove it and find the specific program responsible. A clean boot is the right tool for that. It starts Windows with only Microsoft services running, which quickly reveals whether a background app is interfering with Defender.
Common culprits include leftover antivirus components from a previous installation, system tuner or optimizer utilities, game launchers, virtual machine tools such as VMware or VirtualBox services, and cloud backup or sync utilities. If you only partially uninstalled a third-party antivirus, use that vendor’s dedicated cleanup tool to remove it fully before testing.
Step 1 — Disable non-Microsoft services:
- Press Windows + R, type msconfig, and press Enter.
- Click the Services tab.
- Check the box labelled Hide all Microsoft services. This filters the list so you only see third-party services and cannot accidentally disable a core Windows component.
- Click Disable all, then click Apply.
Step 2 — Disable non-essential startup items:
- Open Task Manager (Ctrl + Shift + Esc) and click the Startup tab (labelled Startup apps on Windows 11).
- Right-click each item that is not essential to Windows and select Disable.
Step 3 — Restart and test:
- Close msconfig and restart your PC.
- Open Task Manager and check whether MsMpEng.exe CPU usage has returned to normal — single digits or low double digits outside of an active scan.
- If usage is now normal, a background app was the cause. Re-enable the disabled services and startup items in small batches, restarting after each batch, until the high CPU usage returns. The last batch you enabled contains the conflicting program.
- Once you have identified the specific app or service, either uninstall it, update it to the latest version, or use the vendor’s official cleanup tool if it is a remnant of a previously installed antivirus.
- When finished, go back to msconfig and re-enable any services you want to keep running normally.
8. The nuclear option
The above solutions are all simple but if your problems persist there are a few other things you can try that are a bit more extreme.
- You can try creating a new user account and deleting the one that you’re experiencing the high CPU usage from Antimalware Service Executable.
- You can perform an in-place repair install using the latest Windows ISO or the Windows Installation Assistant. During setup, choose Keep personal files and apps. This repairs corrupted system files and Defender components without removing your installed programs, making it a safer intermediate step than a full reset. Download the Installation Assistant from Microsoft’s official Windows download page and follow the on-screen prompts.
- You can reset Windows using the Reset this PC option. Be aware that selecting Keep my files preserves your personal files but removes installed desktop applications and many settings — it does not keep your programs. Only choose this option if the repair install above did not resolve the problem.
- You can perform a fresh install, which wipes the drive entirely and gives you a clean slate.
Conclusion
You will find plenty of online advice telling you to uninstall Windows Defender to get rid of antimalware service executable high cpu problems, and that will work. It will also leave you without an antivirus, and we don’t generally recommend something like that. Windows Defender keeps your system safe, and if you decide to remove it, you should replace it with another anti-virus. If you’re considering alternatives, check out our guide to the best antivirus software for Windows 10 and Windows 11 to find a robust replacement. Likewise, changing how the Antimalware Service Executable works isn’t a good idea. Try one of the nuclear options we’ve listed or make sure you have a robust alternative available before you remove it.
