# Fix Antimalware Service Executable High CPU in Windows 11

URL: https://www.mytechnician.tech/tips/fix-antimalware-service-executable-high-cpu-windows-11/
Published: 2026-10-30 | Author: Ankit Kumar
Tags: Windows 11, Performance, Fix
Summary: Antimalware Service Executable (MsMpEng.exe) eating CPU or disk? Cap scan load, reschedule scans, and add safe exclusions without turning Defender off.
Recommended app: Ultimate PC Repair Tool, https://www.mytechnician.tech/apps/my-technician/ (Microsoft Store: https://apps.microsoft.com/detail/9PH863L9C6HC?hl=en-us&cid=mytechnician-web). Optional; every step below uses built-in Windows tools.

## The Problem
Task Manager shows **Antimalware Service Executable** near the top of the CPU, memory, or disk column, and the PC feels sluggish while it runs. The process is `MsMpEng.exe`, the engine of **Microsoft Defender Antivirus**, the antivirus built into Windows 11.

Short bursts are normal. Defender scans files as they are opened, runs a scheduled scan when the PC is idle, and rescans after definition updates. It becomes a problem when it pins the CPU for long stretches while you are working, or every time you open a game, a big project folder, or a download.

The goal is to make Defender cheaper to run, not to turn it off.

## Symptoms
* **Antimalware Service Executable** at 30–100% CPU for minutes at a time.
* High disk activity from the same process right after startup.
* Fans spin up whenever you open large folders, unzip archives, or build code.
* The spike starts at the same time every day, or right after Windows Update installs a definition update.

## Quick Checks
1. Leave the PC alone for 15–30 minutes. If a scheduled or post-update scan is running, it finishes and usage drops back to near zero.
2. Open **Windows Security** → **Virus & threat protection** and check whether a scan is in progress.
3. Check **Protection history** on the same page. A file that is detected over and over (for example, in a downloads or game mods folder) causes repeated scans.

## The Fix: Step-by-Step

### Step 1: Update Defender and Let One Full Scan Finish
1. **Windows Security** → **Virus & threat protection** → **Protection updates** → **Check for updates**.
2. Back on **Virus & threat protection**, choose **Scan options** → **Full scan** → **Scan now**.
3. Let it finish once, ideally overnight.

After a clean full scan, Defender's cache marks unchanged files as already scanned, so later quick scans and on-access checks get much cheaper.

### Step 2: Remove a Second Antivirus (or Turn Off Periodic Scanning)
Two real-time scanners checking every file is the most common cause of constant high CPU.

* If you use another antivirus, Defender should switch itself off automatically. Check **Virus & threat protection**. It should say another provider is active.
* If you see **Microsoft Defender Antivirus options** → **Periodic scanning** turned **On** next to another antivirus, turn it **Off**.
* Uninstall antivirus trials that came preinstalled on the PC, using the vendor's removal tool if one exists.

### Step 3: Cap the CPU Defender Uses During Scans
Defender lets you limit how much CPU a scan can use. The default is 50%.

1. Right-click **Start** → **Terminal (Admin)**.
2. Run:
   ```powershell
   Set-MpPreference -ScanAvgCPULoadFactor 30
   Set-MpPreference -EnableLowCpuPriority $true
   ```
3. Confirm with `Get-MpPreference | Select ScanAvgCPULoadFactor, EnableLowCpuPriority`.

The first command limits scheduled and on-demand scans to about 30% CPU on average. The second runs scheduled scans at low priority so the apps you are using come first. Neither weakens real-time protection. If the command returns an error, the setting is managed by your organization or by Tamper Protection, and you should leave it alone.

### Step 4: Move the Scheduled Scan to Idle Time
1. Press `Win + R`, type `taskschd.msc`, and press Enter.
2. Go to **Task Scheduler Library** → **Microsoft** → **Windows** → **Windows Defender**.
3. Double-click **Windows Defender Scheduled Scan**.
4. On the **Conditions** tab, tick **Start the task only if the computer is idle for** and set **10 minutes**. On a laptop, also tick **Start the task only if the computer is on AC power**.
5. On the **Triggers** tab, add a weekly trigger at a time the PC is on but unused.

More on scheduling: [how to use Task Scheduler in Windows 11](https://www.mytechnician.tech/tips/how-to-use-task-scheduler-windows-11/).

### Step 5: Add Narrow Exclusions for Heavy-Churn Folders
Folders that write thousands of small files make Defender scan constantly: code build output, `node_modules`, virtual machine disks, and game libraries that update often.

1. **Windows Security** → **Virus & threat protection** → **Manage settings**.
2. Scroll to **Exclusions** → **Add or remove exclusions** → **Add an exclusion** → **Folder**.
3. Add only folders you trust and that you write to yourself, such as `D:\VMs` or a project's `build` folder.

Keep exclusions narrow. Never exclude `C:\`, your **Downloads** folder, `%TEMP%`, or the Defender folder itself. These are exactly where malware lands. For developers, a **Dev Drive** (Settings → System → Storage → Advanced storage settings → Disks & volumes → **Create dev drive**) is a better option: Defender scans it in a lighter performance mode instead of not at all.

### Step 6: Fix a Detection That Keeps Coming Back
If **Protection history** shows the same threat repeatedly, Defender is rescanning because something keeps recreating the file.

1. Open the detection and choose **Remove** or **Quarantine**.
2. Uninstall the program or delete the folder that keeps restoring it.
3. Run **Scan options** → **Microsoft Defender Offline scan** to catch anything that hides while Windows is running.

### Step 7: Repair Windows If the Process Misbehaves Constantly
If usage stays high with no scan running and nothing in Protection history, repair the system files Defender depends on:

```
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow
```

Run both from **Terminal (Admin)**, then restart. Details: [repair Windows 11 with SFC and DISM](https://www.mytechnician.tech/tips/how-to-run-sfc-dism-repair-windows-11/).

## What Not to Do
* **Don't disable Defender with registry tweaks or "debloat" scripts.** Windows ignores the old `DisableAntiSpyware` value, and many scripts leave Windows Security broken. If that already happened, see [fix Windows Security not opening](https://www.mytechnician.tech/tips/fix-windows-security-not-opening-windows-11/).
* **Don't exclude `MsMpEng.exe` or the whole system drive.** It barely helps performance and removes protection from everything.
* **Don't turn off real-time protection to "test".** Windows turns it back on later anyway, and you are unprotected while you browse.

## FAQ

### Is Antimalware Service Executable a virus?
No. It is `MsMpEng.exe`, the Microsoft Defender Antivirus engine, and it lives in `C:\ProgramData\Microsoft\Windows Defender\Platform\` or `C:\Program Files\Windows Defender\`. A copy running from anywhere else, such as your user folder, is suspicious and worth a full scan.

### Can I end the Antimalware Service Executable task?
Task Manager refuses with "Access is denied". Defender protects its own process so malware cannot stop it. Use the CPU cap and scheduling steps above instead.

### Why does it use so much memory?
Defender keeps its definition database and scan cache in memory, usually 100–300 MB. That is normal. Over 1 GB for a long time usually means a large scan is running or a second antivirus is conflicting with it.

## Still Slow?
If CPU usage is still high once Defender is calm, the cause is something else. Work through [fix 100% CPU usage](https://www.mytechnician.tech/tips/fix-100-percent-cpu-usage-windows-11/) and [fix 100% disk usage](https://www.mytechnician.tech/tips/how-to-fix-100-disk-usage-windows-11/). Another process that often shows up in the same place is covered in [fix WMI Provider Host high CPU](https://www.mytechnician.tech/tips/fix-wmi-provider-host-high-cpu-windows-11/).

---
Source: https://www.mytechnician.tech/tips/fix-antimalware-service-executable-high-cpu-windows-11/ (My Technician, free Windows 10/11 troubleshooting guides).
Related tool: Ultimate PC Repair Tool (Ultimate PC Repair Tool is a Windows diagnostic and repair toolkit with system analysis, automated troubleshooting, and hardware checks for Windows 10/11.): https://www.mytechnician.tech/apps/my-technician/
More guides: https://www.mytechnician.tech/llms.txt