Antimalware Service Executable High CPU: What Defender Is Doing
Antimalware Service Executable is Microsoft Defender Antivirus, the antivirus built into Windows, and its process file is MsMpEng.exe. When it uses a lot of CPU, it is usually scanning: a scheduled scan, a scan after new security intelligence arrived, or real-time scanning of files that something else is opening right now. Work out which of these it is before changing anything, because each one has a different fix, and none of them needs Defender turned off for good.
What the process is doing
Microsoft's troubleshooting article for Defender performance names the process directly: Anti-malware Service Executable, MsMpEng.exe, Microsoft Defender Antivirus. Its work falls into three groups.
| Source of the work | When it happens | What it looks like |
|---|---|---|
| Real-time protection | Whenever files are opened, closed or launched | CPU follows another task: a build, an installer, unpacking an archive, copying many small files |
| Scheduled scan | On a schedule, by default only when the PC is idle | Starts when you step away, can continue when you come back |
| Scan after a security intelligence update | After new definitions install | Looks like a scan outside the schedule |
Real-time protection is the part most people meet. The same article lists what makes it expensive: unsigned .exe and .dll files that get launched, complex file formats such as HTA and CHM used as data stores, obfuscated scripts, and large files such as .iso or .vhdx sitting in a profile folder that syncs to a network location or OneDrive. A project build that writes thousands of small files is the everyday version of this: every file the compiler writes is a file Defender looks at.
Check first, without changing settings
Press Ctrl + Shift + Esc to open Task Manager, sort by CPU and note what else is busy at the same moment. If Antimalware Service Executable rises and falls with a build, an installer or a large copy, it is real-time scanning that work. If it is busy while nothing else is, a scan is the likelier cause. Wait a few minutes and look again: a scan that finishes is normal behavior, not a fault.
Then open Windows Security from the Start menu and go to Virus & threat protection. Microsoft's Windows Security guide describes Scan options there (Quick scan, Full scan, Custom scan and Microsoft Defender Antivirus (offline scan)) and Protection history. Protection history matters here: if Defender found and is handling something, the CPU use has a reason, and the item listed there is what to act on.
If you need to know exactly which files cost the most, Defender has a performance analyzer. Microsoft's analyzer guide records Defender's scan events while you reproduce the slow task, then reports the top files, paths, extensions and processes by scan time. Run PowerShell as administrator, start the recording, repeat the slow work, then press Enter to stop:
New-MpPerformanceRecording -RecordTo C:\Temp\defender.etl
Get-MpPerformanceReport -Path C:\Temp\defender.etl -TopFiles 10 -TopProcesses 10
The path is an example; use a folder that exists. The report reads data and changes no setting. If the top entries are your own build output or a package cache, you have found the real-time cost; if they are a downloaded archive or a tool you do not recognize, keep scanning it.
Scans: quick is the recommended default
Microsoft's scan guide recommends a quick scan for regular scheduled scans. A quick scan checks places where malware registers itself to start with Windows, such as registry keys and startup folders, and together with real-time protection that is the coverage Microsoft recommends. A full scan reads every fixed drive, can take hours or days on a large disk, and Microsoft generally does not recommend scheduling it. If you started a full scan yourself, the CPU use will last until it finishes.
The same guide notes that Defender checks for updates 15 minutes before a scheduled scan, and the troubleshooting article explains that a scan after a security intelligence update runs by default. That is why a scan can appear at a time you never chose.
To move the scheduled scan away from your working hours, Microsoft's Task Scheduler instructions open Task Scheduler Library › Microsoft › Windows › Windows Defender, then Windows Defender Scheduled Scan, and add a trigger on the Triggers tab. Pick a time when the PC is on but you are not using it, such as a lunch break. Moving the time keeps the scan; it only changes when you pay for it.
Build folders: Dev Drive before exclusions
If the cost comes from development work, Microsoft's answer on Windows 11 is a Dev Drive. It is a separate ReFS volume, at least 50 GB, meant for source repositories, package caches and build output. A trusted Dev Drive runs Defender in performance mode, which Microsoft describes as a secure alternative to folder exclusions: files are still scanned, with less effect on the build. You can check its state from an administrator prompt:
fsutil devdrv query D:
Replace D: with your Dev Drive letter. The C: drive cannot be a Dev Drive, an existing volume cannot be converted without formatting it, and Microsoft recommends keeping developer tools such as Visual Studio and SDKs on C:. Moving caches is a larger change than adding a setting; the Dev Drive page lists the environment variables for npm, NuGet, pip, Cargo, Maven and Gradle. For which of those folders can be cleared instead, see Windows developer caches.
Exclusions: only for folders you trust, and know what you give up
An exclusion stops Defender from scanning that file, folder, file type or process. In Windows Security, Microsoft's exclusion steps go through Virus & threat protection › Manage settings › Add or remove exclusions, and the same page warns that excluded items could leave the device and data vulnerable. Microsoft's exclusion reference also says you usually do not need exclusions at all.
If you still add one, keep it narrow:
- A folder that only your own trusted tools write to, such as one project's build output, not the whole drive or the whole user profile.
- Never Downloads, Desktop, a browser's download folder, or a folder that receives files from email, chat or the internet. Those are where malware arrives.
- A process exclusion covers every file that process opens, so excluding a compiler or a package manager also stops scanning of whatever it downloads.
Each exclusion is a trade: less CPU for that folder, no scanning of anything that lands in it. If the folder ever starts holding downloaded files, remove the exclusion.
What not to do
Do not turn Defender off permanently through the registry, Group Policy, a "debloat" script or a third-party tweak tool. Turning off real-time protection in Windows Security is temporary by design: Microsoft says it turns back on automatically after a short while, and while it is off, files you open or download are not scanned. The troubleshooting article only suggests turning it off briefly, through troubleshooting mode, to rule it out as the cause.
Do not end MsMpEng.exe in Task Manager or delete files from Defender's folders. Do not exclude C:\ or a whole user folder to make a number go down. And if you run another security product as well, Microsoft's article recommends adding each product's processes to the other's exclusions; two scanners inspecting the same files are a known source of high CPU.
Check that the change worked
After moving the schedule, moving a cache to a Dev Drive or adding a narrow exclusion, repeat the same work, such as the same build, and compare. You can record the analyzer again and confirm the folder now shows a skip reason, or that the scan time dropped. In Windows Security, Virus & threat protection should still show protection as on.
Mole does not change Defender settings or exclusions. Its Doctor report, opened from Run Doctor after you click the Mole mark at the top left of the window, shows whether Defender real-time protection is on and flags security intelligence that has not updated for a week, which is worth checking after anyone else has changed the PC's security settings. For CPU use that is not Defender, see High CPU usage on Windows; for a disk stuck at 100%, see Disk at 100% in Task Manager.
FAQ
Is Antimalware Service Executable a virus?
The genuine process is Microsoft Defender Antivirus, MsMpEng.exe, part of Windows. High CPU from it is usually a scan. If Protection history lists a detection, act on that item.
Why does Antimalware Service Executable use high CPU when I am not doing anything?
Scheduled scans run when the PC is idle, and Defender also scans after a security intelligence update by default. A quick scan usually finishes on its own; a full scan can take hours.
Can I disable Antimalware Service Executable?
Not safely. Turning off real-time protection is temporary and Windows turns it back on. Permanent disabling through policy or scripts leaves files unscanned. Reschedule scans or use a Dev Drive instead.
Should I add an exclusion to fix high CPU from Microsoft Defender?
Only for a narrow folder that trusted tools alone write to, such as build output. Microsoft warns exclusions reduce protection; never exclude Downloads, Desktop or a whole drive.