A constantly spinning blue "Working in Background" cursor in Windows 11 can be one of the most frustrating issues for users. Although the computer continues to function normally, the cursor continuously displays the blue loading circle, creating the impression that Windows is constantly processing something.
Many users initially suspect Microsoft Defender Antivirus (MsMpEng.exe) because Task Manager often shows noticeable CPU usage by the Antimalware Service Executable. However, as this case study demonstrates, Defender may only be a secondary process, while the real culprit is a completely different background application.
This article documents a real-world troubleshooting session in which the issue was successfully diagnosed and permanently identified.
The affected Windows 11 laptop exhibited the following behavior:
The first observation showed:
PowerShell verification:
Get-MpComputerStatus | Select AntivirusEnabled,RealTimeProtectionEnabled,QuickScanStartTime,FullScanStartTime
Result:
Threat detection check:
Get-MpThreatDetection
Result:
No threats detected.
Next, Defender versions were verified.
Get-MpComputerStatus |
Select AMServiceVersion,
AntivirusSignatureVersion,
AntispywareSignatureVersion,
NISEngineVersion
Output confirmed:
Therefore outdated Defender definitions were ruled out.
The following troubleshooting steps were performed:
taskkill /f /im explorer.exe
start explorer.exe
Result:
No improvement.
Add-MpPreference -ExclusionPath "$env:LOCALAPPDATA\Google\Chrome\User Data"Add-MpPreference -ExclusionPath "$env:LOCALAPPDATA\Microsoft\Edge\User Data"
Add-MpPreference -ExclusionProcess "chrome.exe"
Purpose:
Reduce unnecessary browser cache scanning.
Result:
Busy cursor still remained.
PowerShell:
Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" -MaxEvents 20
Observed Events:
Event ID 5007
Initially appeared suspicious.
Detailed investigation revealed:
These were expected events caused by administrative changes.
Therefore Event ID 5007 was not the root cause.
Microsoft Sysinternals Process Explorer was used for deeper analysis.
Initial findings:
A later observation showed:
This proved:
Process Explorer revealed another ASUS background process:
AsusPTPCenter.exe
Also displayed as:
ASUS Smart Gesture Center
or
ASUS Precision Touchpad Center
The following process was terminated:
AsusPTPCenter.exe
Immediately afterward:
This confirmed the root cause.
The continuous busy cursor was caused by:
ASUS Precision Touchpad Center (AsusPTPCenter.exe)
Not by:
Microsoft Defender CPU usage observed earlier was only incidental and not responsible for the permanent busy cursor.
Update the ASUS Precision Touchpad driver directly from ASUS Support.
Disable:
AsusPTPCenter.exe
from Startup Apps.
If Windows Precision Touchpad works correctly:
Uninstall:
Windows will generally continue using Microsoft's built-in Precision Touchpad driver.
Reinstall the latest ASUS touchpad package.
Check Defender status:
Get-MpComputerStatus
Check threats:
Get-MpThreatDetection
Check Defender version:
Get-MpComputerStatus |
Select AMServiceVersion,
AntivirusSignatureVersion,
AntispywareSignatureVersion
Restart Explorer:
taskkill /f /im explorer.exe
start explorer.exe
Add Chrome exclusion:
Add-MpPreference -ExclusionPath "$env:LOCALAPPDATA\Google\Chrome\User Data"
Add Edge exclusion:
Add-MpPreference -ExclusionPath "$env:LOCALAPPDATA\Microsoft\Edge\User Data"
Exclude Chrome process:
Add-MpPreference -ExclusionProcess "chrome.exe"
List mouse devices:
Get-PnpDevice -Class Mouse
After extensive troubleshooting, the issue was conclusively traced to AsusPTPCenter.exe (ASUS Precision Touchpad Center).
Terminating this single process immediately restored the normal mouse pointer, while Microsoft Defender continued functioning normally. Updating, disabling, or reinstalling the ASUS touchpad software provides the most effective long-term solution.
This case demonstrates the importance of systematic troubleshooting. Rather than assuming Microsoft Defender was responsible because of temporary CPU usage, analyzing processes, reviewing Defender logs, and isolating third-party background utilities led to the actual root cause and a clean, reliable resolution.
Windows 11, blue busy cursor, spinning cursor, working in background, AsusPTPCenter, ASUS Precision Touchpad, ASUS Smart Gesture, Microsoft Defender, Antimalware Service Executable, MsMpEng.exe, high CPU, Windows troubleshooting, cursor always busy, touchpad driver, ASUS driver, Windows cursor fix, Process Explorer, Sysinternals, Task Manager, Event Viewer, Event ID 5007, Defender logs, Windows Security, PowerShell, Get-MpComputerStatus, Get-MpThreatDetection, Add-MpPreference, Chrome exclusion, Edge exclusion, Explorer restart, taskkill explorer, Windows Explorer, desktop issue, mouse pointer, Sumeet Kohli, Shally Narang, loading cursor, Windows performance, CPU usage, background process, startup apps, Windows optimization, driver conflict, HID driver, Precision Touchpad, Smart Gesture Center, system diagnostics, Windows utilities, troubleshooting guide, case study, performance analysis, Windows support, laptop issue, ASUS laptop, Windows repair, process monitoring, Resource Monitor, Process Monitor, Defender exclusions, security intelligence, antivirus troubleshooting, Windows admin, IT support, desktop support, helpdesk, Windows maintenance, system health, software conflict, cursor blinking, Windows bug, input driver, touchpad utility, Windows services, startup optimization, background tasks, shell troubleshooting, mouse issue, pointer problem, IT engineer, enterprise support, technical guide, Windows tools, CPU diagnostics, Microsoft tools, system repair, application conflict, cursor diagnosis, Windows 11 fix, Defender CPU, antivirus optimization, process analysis, ASUS utility, desktop responsiveness, troubleshooting workflow, Windows administration, performance tuning, software debugging, endpoint support, system optimization, Windows case study, Bison Infosolutions