How to Stop Antimalware Service Executable from Causing High CPU and Disk Usage in Windows

Quick Answer

The Antimalware Service Executable (MsMpEng.exe) is a legitimate Windows process used by Microsoft Defender Antivirus. It runs in the background to provide real-time protection, scan files, detect malware and protect your computer from security threats.

High CPU or disk usage from this process can occur during a full antivirus scan, Windows updates, software installation, large file transfers or when Defender repeatedly scans files that are frequently modified. Occasional spikes are normal. However, consistently high resource usage can indicate a scanning conflict, outdated security definitions, corrupted system files or an application generating excessive file activity.

To reduce the problem safely:

• Allow an active antivirus scan to finish.
• Restart Windows and install available updates.
• Update Microsoft Defender security intelligence.
• Check which files or processes are causing repeated scans.
• Use Microsoft Defender Performance Analyzer to identify scanning bottlenecks.
• Configure exclusions only for specific, trusted files or folders when necessary.

Important: Do not delete MsMpEng.exe, terminate it permanently or disable real-time protection just to reduce CPU or disk usage. Doing so can leave Windows less protected.

What Is Antimalware Service Executable?

Antimalware Service Executable is the process associated with Microsoft Defender Antivirus. Its executable file is commonly named MsMpEng.exe. Microsoft Defender is built into Windows and provides protection against viruses, malware, ransomware and other security threats.

The process performs several security-related tasks, including:

• Real-time protection: Checks files and programs when they are accessed, downloaded, opened or executed.
• Scheduled scanning: Runs antivirus scans according to Windows security settings and maintenance schedules.
• Threat detection: Examines suspicious files, applications and system activity.
• Security intelligence updates: Uses updated threat definitions to identify newly discovered malware.
• Remediation: Helps quarantine or remove detected threats.

Because Defender monitors file activity, its resource usage can increase when many files are created, modified, downloaded or accessed. This is particularly noticeable during software installations, large downloads, development work, archive extraction and system updates.

Why Does Antimalware Service Executable Use High CPU or Disk?

Several conditions can cause MsMpEng.exe to consume more system resources than usual.

1. Windows Defender Is Performing a Scan

During a quick, full or custom scan, Microsoft Defender examines files and folders for potential threats. A full scan can access a large number of files, resulting in increased CPU and disk usage.

2. Real-Time Protection Is Scanning Frequently Accessed Files

Real-time protection checks files whenever applications access or modify them. Some workloads, such as software development, virtual machines, database operations and large file transfers, can generate substantial file activity.

3. Security Intelligence Is Outdated

Outdated antivirus definitions may prevent Defender from using the latest threat information. Updating security intelligence can resolve some detection and scanning-related issues.

4. Another Security Application Is Installed

Running multiple antivirus products can create unnecessary scanning activity or compatibility problems. If another antivirus product is installed, check whether it is configured correctly and whether Microsoft Defender has automatically adjusted its operating mode.

5. A File or Folder Is Causing Repeated Scanning

Some applications continuously create or modify files. If Defender repeatedly scans these files, resource usage may remain high. A specific application, development environment, backup process or virtual machine may be responsible.

6. Windows or Defender Components Need Updating

Outdated Windows components, antivirus platform issues or corrupted system files can sometimes contribute to abnormal resource consumption.

How to Fix Antimalware Service Executable High CPU or Disk Usage

Method 1: Wait for the Current Scan to Finish

Before changing any security settings, check whether Microsoft Defender is performing an active scan.

1. Press Windows + I to open Settings.
2. Navigate to Privacy & security > Windows Security.
3. Open Virus & threat protection.
4. Check the protection status and scan information.
5. If a scan is running, allow it to complete.

After the scan finishes, monitor CPU and disk usage again. If resource consumption returns to normal, no additional changes may be necessary.

Method 2: Restart Your Computer

A restart can clear temporary system problems and allow Windows security services to start again normally.

1. Save your open work.
2. Open the Start menu.
3. Select Power > Restart.
4. After Windows starts, open Task Manager.
5. Check whether Antimalware Service Executable continues to use excessive resources.

If the issue returns immediately or remains persistent, continue with the following methods.

Method 3: Update Microsoft Defender Security Intelligence

Installing the latest security intelligence updates ensures that Microsoft Defender has current threat definitions.

1. Open Windows Security.
2. Select Virus & threat protection.
3. Scroll to Virus & threat protection updates.
4. Click Protection updates.
5. Select Check for updates.
6. Allow the update process to complete.

You can also check for Windows updates through Settings > Windows Update > Check for updates.

Method 4: Check Which Process Is Using CPU and Disk Resources

Task Manager can help determine whether MsMpEng.exe is responsible for the performance problem.

1. Press Ctrl + Shift + Esc to open Task Manager.
2. Select the Processes tab.
3. Click the CPU column to sort processes by CPU usage.
4. Click the Disk column to sort processes by disk activity.
5. Locate Antimalware Service Executable.
6. Observe its resource usage for several minutes.

If usage increases only during scans or certain activities, the behaviour may be expected. If it remains unusually high while the computer is idle, investigate the cause using the next methods.

Method 5: Identify Problematic Files with Microsoft Defender Performance Analyzer

Microsoft provides a Performance Analyzer for Defender Antivirus. It helps administrators identify which files, processes and paths are contributing to antivirus scanning performance problems.

This is particularly useful when Defender repeatedly scans files created by a specific application.

Step 1: Open PowerShell as Administrator

1. Open the Start menu.
2. Search for PowerShell.
3. Right-click Windows PowerShell or Terminal.
4. Select Run as administrator.

Step 2: Start a performance recording

Run the following command:

New-MpPerformanceRecording -RecordTo "$env:USERPROFILE\Desktop\DefenderPerformance.etl"

Reproduce the activity that causes high CPU or disk usage while the recording is running. For example, open the application that causes the problem or repeat the file operation associated with the slowdown.

When you have captured the activity, press Enter in the PowerShell window to stop and save the recording.

Step 3: Generate the performance report

Run:

Get-MpPerformanceReport -Path "$env:USERPROFILE\Desktop\DefenderPerformance.etl"

The report can help identify files, processes and paths associated with Defender scanning activity. Review the results to determine whether a particular application or workload is generating excessive scanning.

Note: Run these commands from an elevated PowerShell session. The recording file may contain information about file paths and application activity, so handle it appropriately.

Method 6: Add a Microsoft Defender Exclusion Only When Necessary

If the performance report identifies a trusted application or specific folder that is repeatedly scanned, a carefully selected exclusion may reduce unnecessary scanning.

However, exclusions reduce antivirus inspection for the selected location or file. Malware stored there may not receive the same level of protection. Do not exclude your entire system drive, Downloads folder, temporary folders or broad application directories simply to improve performance.

To add a specific exclusion:

1. Open Windows Security.
2. Select Virus & threat protection.
3. Under Virus & threat protection settings, click Manage settings.
4. Scroll to Exclusions.
5. Select Add or remove exclusions.
6. Click Add an exclusion.
7. Select the appropriate type, such as File, Folder or Process.
8. Choose only the specific trusted item that has been identified as a cause of unnecessary scanning.

Use process exclusions cautiously. They can have broader security implications than excluding a single file. Remove an exclusion if it is no longer required.

Method 7: Check for Malware or Suspicious Applications

Unusual system activity may be caused by malware or an unwanted application. Although MsMpEng.exe is a legitimate Windows process, its name alone does not prove that a process is genuine.

To verify its location:

1. Open Task Manager.
2. Locate Antimalware Service Executable.
3. Right-click it and select Open file location, if available.
4. Check whether the executable is located in the expected Microsoft Defender platform directory under C:\ProgramData\Microsoft\Windows Defender\Platform.

Do not delete the file or assume that every process with a similar name is legitimate. If the location looks suspicious, run a Microsoft Defender scan and investigate further.

To run a full scan:

1. Open Windows Security.
2. Select Virus & threat protection.
3. Click Scan options.
4. Select Full scan.
5. Click Scan now.

If you suspect a persistent infection, consider using Microsoft Defender Offline scan from the same Scan options page. Save your work first because the computer will restart.

Method 8: Repair Windows System Files

Corrupted Windows system files can cause unexpected operating-system behaviour. You can use the built-in System File Checker and Deployment Image Servicing and Management tools to check and repair Windows components.

Open Command Prompt or Windows Terminal as Administrator and run the following commands one at a time.

First, repair the Windows component store:

DISM /Online /Cleanup-Image /RestoreHealth

Wait for the operation to complete. Then run System File Checker:

sfc /scannow

Allow the scan to finish and follow any repair instructions. Restart Windows and check whether the issue has improved.

How to Reduce Defender Scanning Impact Safely

If Microsoft Defender is functioning correctly but scheduled scans affect performance, consider reviewing its scan schedule and system maintenance settings.

• Schedule resource-intensive scans for periods when the computer is not being used heavily.
• Avoid running multiple intensive scans simultaneously.
• Keep Windows and Microsoft Defender updated.
• Investigate applications that repeatedly generate or modify large numbers of files.
• Use performance analysis before creating exclusions.

On managed business computers, scan schedules and security policies may be controlled by an administrator or organisation. Do not change centrally managed settings without approval.

What You Should Not Do

Some online troubleshooting suggestions can reduce Defender activity by weakening Windows security. Avoid the following actions:

• Do not delete MsMpEng.exe: It is part of Microsoft Defender Antivirus.
• Do not permanently disable real-time protection: This reduces protection against malware.
• Do not terminate Defender services: Forcing security services to stop can create protection problems and may not resolve the underlying cause.
• Do not exclude entire drives: Broad exclusions can leave important files unprotected.
• Do not download replacement executables: Obtain Windows security components and updates through trusted Microsoft channels.

Frequently Asked Questions

Is Antimalware Service Executable a virus?

No. Antimalware Service Executable is a legitimate Microsoft Defender Antivirus process. However, malware can imitate legitimate process names. If you suspect a problem, verify the executable location and run a security scan.

Why does MsMpEng.exe use high CPU when the computer is idle?

Defender may be performing scheduled maintenance, background scanning or security intelligence updates. If CPU usage remains high for an extended period, check Task Manager, review updates and use Defender Performance Analyzer to identify the source of scanning activity.

Why does Antimalware Service Executable use high disk usage?

Microsoft Defender reads files during real-time protection and antivirus scans. Large file collections, software installations, application updates and frequently modified files can increase disk activity.

Can I disable Antimalware Service Executable?

It is not recommended. The process supports Microsoft Defender's antivirus protection. Disabling it can expose your computer to malware and other threats. Identify and resolve the cause of excessive resource usage instead.

Is it safe to add an exclusion in Microsoft Defender?

It can be appropriate when a specific trusted file or application is confirmed to cause unnecessary scanning. However, exclusions reduce protection for the selected item. Keep exclusions narrow, review them regularly and never exclude an entire drive without a well-justified security decision.

Does high CPU usage mean my computer is infected?

No. High CPU usage alone does not indicate malware infection. Defender scans, Windows updates and normal application activity can increase resource usage. If you notice other suspicious behaviour, perform a full scan and investigate further.

Conclusion

Antimalware Service Executable is an important part of Microsoft Defender Antivirus. Temporary increases in CPU or disk usage are often normal, especially during scans, updates and intensive file operations.

If the problem continues, update Defender, check Task Manager, investigate repeated scanning with Microsoft Defender Performance Analyzer and repair Windows system files if necessary. Use exclusions only when a specific trusted file or application has been identified as the cause.

The best solution is to identify why Defender is consuming resources rather than disabling antivirus protection. This helps maintain system performance without compromising Windows security.

Sources and Further Reading

• Microsoft Learn: Tune performance for Microsoft Defender Antivirus
• Microsoft Learn: Microsoft Defender Antivirus Performance Analyzer reference
• Microsoft Learn: Configure contextual file and folder exclusions
• Microsoft Support: Antivirus and antimalware software FAQ