Skip to content
PCDecoder
MsMpEng.exeAntimalware Service ExecutableProcessWidely reported

Antimalware Service Executable (MsMpEng.exe) high CPU: what it is and what to do

By Gaurav Rawat · Updated Oct 2, 2026 · Checked against Microsoft documentation · How this page is made

Quick answer

Antimalware Service Executable (MsMpEng.exe) is the engine behind Microsoft Defender Antivirus. Short bursts of high CPU during a scan or update are normal. If it stays high, move the scheduled scan to a time you're not using the PC, make sure you aren't running two antivirus products, and only exclude folders you trust.

What it means

MsMpEng.exe is Microsoft Defender Antivirus doing its job. Task Manager shows it as Antimalware Service Executable. It checks files as they're opened and saved, runs scheduled scans, and installs new threat definitions.

Most of the time it uses very little. It gets busy when:

  • a scheduled scan runs, often when the PC has been idle for a while;
  • you copy, unzip or install lots of files, because each one is scanned as it lands;
  • a definition or engine update installs;
  • another program creates or changes files constantly, as development tools, backup software and games' launchers can do.

Don't turn it off

Disabling Defender to save CPU leaves the PC unprotected, and Windows turns real-time protection back on by itself anyway. The aim is to make the busy periods happen at better times, not to remove them.

Common causes

  • A scheduled or quick scan running while you use the PC.
  • Copying, extracting or installing a large number of files.
  • Definition updates installing in the background.
  • A second antivirus product scanning the same files at the same time.
  • An app or developer tool that writes thousands of small files.

How to fix it

Safest and most likely fixes first. Readers' answers to "Did this fix it?" reorder this list over time.

  1. Let the scan finish

    If CPU use started recently and the PC was idle before.

    1. Open Windows Security > Virus & threat protection.
    2. If a scan is in progress, let it finish. It's quickest when you aren't using the PC heavily.
    3. Check Task Manager again afterwards. Usage should fall back to near zero.
    Did this fix it?

  2. Move the scheduled scan to a better time

    If the slowdown happens at the same time of day.

    1. Press Win + R, type taskschd.msc and press Enter.
    2. Go to Task Scheduler Library > Microsoft > Windows > Windows Defender.
    3. Open Windows Defender Scheduled Scan, go to the Triggers tab and set a time when the PC is on but you're away, such as lunchtime.
    Did this fix it?

  3. Run only one antivirus

    If you have another antivirus installed alongside Defender.

    1. Open Windows Security > Virus & threat protection and check which provider is active.
    2. If you rely on a third-party antivirus, keep it updated and let Defender switch to passive mode, which it does automatically.
    3. If you don't need the third-party product, uninstall it from Settings > Apps > Installed apps.
    Did this fix it?

  4. Exclude a trusted, busy folder

    For folders you trust that change constantly, such as a game library or a code project. Use sparingly.

    1. Open Windows Security > Virus & threat protection > Manage settings.
    2. Under Exclusions, select Add or remove exclusions > Add an exclusion > Folder.
    3. Choose only the specific folder, never a whole drive or your Downloads folder.
    Did this fix it?

Is it just you?

25+ Microsoft Q&A threads discuss this. Most recent activity:

Checked Oct 2, 2026. Refreshed automatically every few days.

Sources

Frequently asked questions

Is Antimalware Service Executable a virus?

No. It's Microsoft Defender Antivirus, which comes with Windows.

Can I disable Antimalware Service Executable?

You can pause real-time protection briefly, but Windows turns it back on. Leaving the PC without antivirus isn't worth the CPU it saves.

Why does MsMpEng.exe use high CPU when the PC is idle?

Defender schedules its scans for idle periods, so seeing it busy just after you come back to the PC is normal.

Written by

Gaurav Rawat

Gaurav Rawat is a full-stack developer from Jaipur with a B.Tech in Information Technology. At PC Decoder, he writes practical guides on Windows 11 updates, error codes, and fixes for apps that stop working after an update, with an emphasis on clear steps that actually solve the problem.

More from Gaurav Rawat

More processs decoded