Antimalware Service Executable (MsMpEng.exe) is the background process that powers Windows Security, Microsoft’s built-in platform for virus, spyware, and malware protection. Under normal conditions it uses minimal CPU, but on some systems it spikes to 30% or higher, making apps feel sluggish and unresponsive. The most common triggers are a scheduled full scan, outdated virus definition files, or a conflict with a second security program installed alongside Windows Defender.
To confirm MsMpEng.exe is responsible, press Ctrl+Shift+Esc to open Task Manager, click the Processes tab, and look for “Antimalware Service Executable.” If its CPU column shows consistently high usage, the fixes below apply. Scheduled scans also cause temporary spikes — if the high usage only happens during idle periods, Windows Defender is running its routine scan. For persistent high CPU that does not drop after 30 minutes, work through the fixes in order. Note that Windows Update services can run simultaneously with Defender scans and compound the CPU load, so checking both is worthwhile.
Quick Answer
Open Windows Security, go to Virus & threat protection > Manage settings, and toggle off Real-time protection to immediately reduce MsMpEng CPU usage. For a lasting fix, return to Manage settings, scroll to Exclusions, click Add or remove exclusions, and add folders that Defender scans repeatedly. If CPU stays high, open Windows Update and install all pending updates including Defender definition updates. For a software conflict, press Win+R, type msconfig, go to the Services tab, check Hide all Microsoft services, click Disable all, then restart to isolate the conflicting program.
How to Fix Antimalware Service Executable High CPU Usage
Fix 1: Disable Windows Defender Real-Time Protection
Turning off real-time protection stops MsMpEng from scanning files continuously, which immediately reduces CPU load. This is a diagnostic and temporary step — leaving protection off exposes your PC to malware, so re-enable it once you have a permanent solution in place.
- Open the Start menu and type “Windows Security.”
Click on the top result to open the Windows Security app.
- In the app, click on “Virus & threat protection” in the left sidebar.
- Under “Virus & threat protection settings,” click on “Manage settings.”
- Toggle off the switch for “Real-time protection.”
- A warning notification will appear; press “Yes” to confirm.
After disabling real-time protection, check Task Manager to confirm MsMpEng CPU usage has dropped. Re-enable the toggle once you have applied a permanent fix, since leaving protection off exposes your computer to malware.
Fix 2: Exclude Files and Folders from Windows Defender
If MsMpEng spikes when you open specific apps or access certain folders, Windows Defender is likely rescanning those locations on every file change. Adding them to the exclusions list prevents repeated scans without disabling protection entirely.
- Open the Start menu and type “Windows Security.”
Click on the top result to open the Windows Security app.
- In the app, click on “Virus & threat protection” in the left sidebar.
- Click on “Manage settings.”
- Under “Exclusions,” click on “Add or remove exclusions.”
- Click on “Add an exclusion” and select either “File” or “Folder.”
- Browse to the file or folder you want to exclude and click “Open.”
- Repeat for any additional files or folders you want to exclude.
- Restart your computer for the changes to take effect.
After adding exclusions, monitor CPU usage in Task Manager to verify the improvement. Avoid excluding system directories or program folders that could contain active threats, as this reduces your overall protection coverage.
Fix 3: Update Windows and Windows Defender
Outdated virus definitions cause Windows Defender to work harder during scans, since its detection engine runs against a less optimized database. Keeping Windows and Defender updated also patches known bugs that can cause MsMpEng to consume excessive CPU. If you are experiencing issues with Windows Update services not running correctly, address those first before proceeding with this step.
- Open the Start menu and type “Windows Update.”
- Click on the top result to open Windows Update.
- If updates are available, click “Download and install.”
- Once the updates are installed, restart your computer.
- Open Windows Security again and check for any Windows Defender definition updates.
- If updates are available, click “Install now” and wait for them to finish.
- Restart your computer again after the definition updates install.
After updating, check Task Manager to confirm MsMpEng CPU usage has returned to normal. If high usage persists, move on to Fix 4.
Fix 4: Perform a Clean Boot
If none of the previous fixes resolved the issue, a third-party program running in the background is likely conflicting with Windows Defender and triggering constant rescans. A clean boot starts Windows with only Microsoft services active, allowing you to isolate the problematic software.
- Press Win+R to open the Run dialog box.
- Type “msconfig” and press Enter.
- Go to the “Services” tab and check “Hide all Microsoft services.”
- Click “Disable all,” then click “Apply.”
- Go to the “Startup” tab and click “Open Task Manager.”
- In Task Manager, right-click each startup item and select “Disable.”
- Close Task Manager, click “OK” in System Configuration, and restart your computer.
- After the restart, check Task Manager to see if MsMpEng CPU usage is normal.
If high CPU usage is resolved after the clean boot, re-enable services and startup items one group at a time, restarting after each batch, until the conflict reappears. Once you identify the conflicting program, uninstall or update it to permanently fix the issue. The clean boot technique is also useful for diagnosing other Windows configuration problems, such as Windows Spotlight not updating on the lock screen.