Fix Antimalware Service Executable High CPU in Windows 11

•
By My Technician Editorial Team · Edited by Ankit Kumar
Windows 11PerformanceFix
On this page

The Problem

Task Manager shows Antimalware Service Executable near the top of the CPU, memory, or disk column, and the PC feels sluggish while it runs. The process is MsMpEng.exe, the engine of Microsoft Defender Antivirus, the antivirus built into Windows 11.

Short bursts are normal. Defender scans files as they are opened, runs a scheduled scan when the PC is idle, and rescans after definition updates. It becomes a problem when it pins the CPU for long stretches while you are working, or every time you open a game, a big project folder, or a download.

The goal is to make Defender cheaper to run, not to turn it off.

Symptoms

  • Antimalware Service Executable at 30–100% CPU for minutes at a time.
  • High disk activity from the same process right after startup.
  • Fans spin up whenever you open large folders, unzip archives, or build code.
  • The spike starts at the same time every day, or right after Windows Update installs a definition update.

Quick Checks

  1. Leave the PC alone for 15–30 minutes. If a scheduled or post-update scan is running, it finishes and usage drops back to near zero.
  2. Open Windows Security → Virus & threat protection and check whether a scan is in progress.
  3. Check Protection history on the same page. A file that is detected over and over (for example, in a downloads or game mods folder) causes repeated scans.

The Fix: Step-by-Step

Step 1: Update Defender and Let One Full Scan Finish

  1. Windows Security → Virus & threat protection → Protection updates → Check for updates.
  2. Back on Virus & threat protection, choose Scan options → Full scan → Scan now.
  3. Let it finish once, ideally overnight.

After a clean full scan, Defender's cache marks unchanged files as already scanned, so later quick scans and on-access checks get much cheaper.

Step 2: Remove a Second Antivirus (or Turn Off Periodic Scanning)

Two real-time scanners checking every file is the most common cause of constant high CPU.

  • If you use another antivirus, Defender should switch itself off automatically. Check Virus & threat protection. It should say another provider is active.
  • If you see Microsoft Defender Antivirus options → Periodic scanning turned On next to another antivirus, turn it Off.
  • Uninstall antivirus trials that came preinstalled on the PC, using the vendor's removal tool if one exists.

Step 3: Cap the CPU Defender Uses During Scans

Defender lets you limit how much CPU a scan can use. The default is 50%.

  1. Right-click Start → Terminal (Admin).
  2. Run: 
    Set-MpPreference -ScanAvgCPULoadFactor 30
Set-MpPreference -EnableLowCpuPriority $true
  3. Confirm with Get-MpPreference | Select ScanAvgCPULoadFactor, EnableLowCpuPriority.

The first command limits scheduled and on-demand scans to about 30% CPU on average. The second runs scheduled scans at low priority so the apps you are using come first. Neither weakens real-time protection. If the command returns an error, the setting is managed by your organization or by Tamper Protection, and you should leave it alone.

Step 4: Move the Scheduled Scan to Idle Time

  1. Press Win + R, type taskschd.msc, and press Enter.
  2. Go to Task Scheduler Library → Microsoft → Windows → Windows Defender.
  3. Double-click Windows Defender Scheduled Scan.
  4. On the Conditions tab, tick Start the task only if the computer is idle for and set 10 minutes. On a laptop, also tick Start the task only if the computer is on AC power.
  5. On the Triggers tab, add a weekly trigger at a time the PC is on but unused.

More on scheduling: how to use Task Scheduler in Windows 11.

Step 5: Add Narrow Exclusions for Heavy-Churn Folders

Folders that write thousands of small files make Defender scan constantly: code build output, node_modules, virtual machine disks, and game libraries that update often.

  1. Windows Security → Virus & threat protection → Manage settings.
  2. Scroll to Exclusions → Add or remove exclusions → Add an exclusion → Folder.
  3. Add only folders you trust and that you write to yourself, such as D:\VMs or a project's build folder.

Keep exclusions narrow. Never exclude C:\, your Downloads folder, %TEMP%, or the Defender folder itself. These are exactly where malware lands. For developers, a Dev Drive (Settings → System → Storage → Advanced storage settings → Disks & volumes → Create dev drive) is a better option: Defender scans it in a lighter performance mode instead of not at all.

Step 6: Fix a Detection That Keeps Coming Back

If Protection history shows the same threat repeatedly, Defender is rescanning because something keeps recreating the file.

  1. Open the detection and choose Remove or Quarantine.
  2. Uninstall the program or delete the folder that keeps restoring it.
  3. Run Scan options → Microsoft Defender Offline scan to catch anything that hides while Windows is running.

Step 7: Repair Windows If the Process Misbehaves Constantly

If usage stays high with no scan running and nothing in Protection history, repair the system files Defender depends on:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Run both from Terminal (Admin), then restart. Details: repair Windows 11 with SFC and DISM.

What Not to Do

  • Don't disable Defender with registry tweaks or "debloat" scripts. Windows ignores the old DisableAntiSpyware value, and many scripts leave Windows Security broken. If that already happened, see fix Windows Security not opening.
  • Don't exclude MsMpEng.exe or the whole system drive. It barely helps performance and removes protection from everything.
  • Don't turn off real-time protection to "test". Windows turns it back on later anyway, and you are unprotected while you browse.

FAQ

Is Antimalware Service Executable a virus?

No. It is MsMpEng.exe, the Microsoft Defender Antivirus engine, and it lives in C:\ProgramData\Microsoft\Windows Defender\Platform\ or C:\Program Files\Windows Defender\. A copy running from anywhere else, such as your user folder, is suspicious and worth a full scan.

Can I end the Antimalware Service Executable task?

Task Manager refuses with "Access is denied". Defender protects its own process so malware cannot stop it. Use the CPU cap and scheduling steps above instead.

Why does it use so much memory?

Defender keeps its definition database and scan cache in memory, usually 100–300 MB. That is normal. Over 1 GB for a long time usually means a large scan is running or a second antivirus is conflicting with it.

Still Slow?

If CPU usage is still high once Defender is calm, the cause is something else. Work through fix 100% CPU usage and fix 100% disk usage. Another process that often shows up in the same place is covered in fix WMI Provider Host high CPU.

Related guides