So Task Manager shows Antimalware Service Executable (MsMpEng.exe) hogging your CPU and you want it fixed — safely, without breaking your antivirus. Here’s the direct answer, step by step, in the order a technician would actually work it.

The core idea: this process is Microsoft Defender doing its job. High CPU means it’s busy, so the fix is finding what it’s busy with and removing that burden — not disabling the protection. Let’s go.

If you want the deeper diagnostic version, see troubleshooting Antimalware Service Executable ; for the Windows 10 variant, there’s a dedicated Windows 10 guide .

Why this happens

  • A scheduled scan is running: Defender’s full scan is CPU-intensive and runs on its own schedule.
  • Real-time scanning of busy folders: Constantly changing folders get rescanned on every access.
  • Post-update re-scan: Windows updates trigger broad Defender re-baselining for a day or two.
  • Stale definitions: Outdated threat intelligence makes the engine work inefficiently.
  • Corrupt Defender components: A damaged installation scans poorly or loops.
  • Leftover third-party antivirus drivers: Old security software remnants conflicting at the driver level.
  • Genuine threat activity: Occasionally it’s fighting real malware — check before assuming otherwise.

How to fix it

Work through these in order — diagnose first, then act.

Fix 1: Check what Defender is doing right now

Two minutes of looking saves an hour of guessing.

  1. Open Windows Security (search it in Start) > Virus & threat protection > Protection history. Look at the timestamps — any scans, quarantines, or blocked items matching your high-CPU periods?
  2. If Protection history shows active threat remediation, stop here and let it finish — that’s Defender legitimately protecting you, and interrupting it is the wrong move.
  3. Note whether the CPU is constant or tied to your activity. Constant = schedule or corruption. Spikes when you compile code, game, or sync files = specific folders being rescanned.
  4. Open Task Manager > Details tab and confirm the process is genuinely MsMpEng.exe (not something with a similar name from a strange location).
  5. With your pattern identified (scan / folder / constant-unknown), pick the matching fix below.

Fix 2: Move the scheduled scan to the middle of the night

If Fix 1 points at the scan schedule.

  1. Press Win+R, type taskschd.msc, press Enter to open Task Scheduler.
  2. Navigate to Task Scheduler Library > Microsoft > Windows > Windows Defender in the left pane.
  3. Right-click Windows Defender Scheduled Scan > Properties > go to the Triggers tab > Edit (or New) — set it to run daily at 3:00 AM.
  4. Switch to the Conditions tab: check Start the task only if the computer is idle for 30 minutes and Stop if the computer ceases to be idle.
  5. Click OK (enter your password if prompted). Over the next few days, verify in the task’s History tab that scans now run overnight and your daytime CPU is calm.

Fix 3: Exclude your busiest trusted folders

The fix that helps the most people.

  1. Think about which folders churn constantly on your machine: programming projects (especially with node_modules or build output), Steam/Epic game libraries, video editing cache folders, virtual machine disks, cloud sync folders with frequent changes.
  2. Windows Security > Virus & threat protection > Virus & threat protection settings > Manage settings > scroll to Exclusions > Add or remove exclusions.
  3. Click Add an exclusion > Folder and add each high-churn trusted folder, one at a time.
  4. What NOT to exclude: your Downloads folder, Temp folders, email attachments, or entire drives like C:. Exclusions are for places you control and trust.
  5. Use the computer normally for 24 hours, then check Task Manager — MsMpEng.exe should now spike briefly on genuinely new files instead of camping at high CPU. Microsoft documents exclusions further at Windows support .

An outdated engine is an inefficient engine.

  1. Windows Security > Virus & threat protection > Protection updates > Check for updates. Install the latest security intelligence.
  2. Settings > Windows Update > Check for updates — install all pending updates. Defender platform improvements ship through Windows Update.
  3. Restart your laptop after the updates install.
  4. Optional but useful: run one manual Quick scan from Virus & threat protection to confirm the updated engine runs cleanly.
  5. Monitor for a day — definition and platform updates quietly resolve whole categories of scanning inefficiency, and this step is the easiest win on the list.

Fix 5: Clear out old antivirus leftovers

A hidden cause on many machines.

  1. Ask yourself: has this laptop ever had Norton, McAfee, Avast, AVG, Kaspersky, Bitdefender, or similar — including the trial that came preinstalled? If yes (or “I don’t know”), keep reading.
  2. Settings > Apps > Installed apps — uninstall any third-party security software you find.
  3. Important: download that vendor’s official removal tool (Google “[product] removal tool” — every major vendor has one) and run it. Normal uninstalls leave behind filter drivers; these tools remove them.
  4. Restart, then open Windows Security and confirm Microsoft Defender is the active provider with real-time protection on and no warnings.
  5. Watch MsMpEng CPU over the next day — leftover filter drivers cause some of the most stubborn cases, and removing them often fixes it completely.

Fix 6: Repair Defender with system tools

When the engine itself seems damaged.

  1. Open Terminal as administrator (right-click Start > Terminal (Admin)).
  2. Run DISM /Online /Cleanup-Image /RestoreHealth and wait for it to finish (10–20 minutes).
  3. Then run sfc /scannow and wait for that too.
  4. Restart your laptop.
  5. Check Windows Security for any yellow “actions needed” warnings and resolve them — an unhealthy Defender state keeps MsMpEng working overtime even when there’s nothing to scan.

Fix 7: Rule out malware, then verify the fix holds

Close the loop properly.

  1. Windows Security > Virus & threat protection > Scan options > select Microsoft Defender Offline scan > Scan now. The laptop will reboot into a clean scanning environment — let it complete.
  2. When you’re back in Windows, review Protection history once more for anything the offline scan found.
  3. Now verify: use the laptop normally for 2–3 days, glancing at Task Manager during your typical heavy activities. MsMpEng should show brief spikes, not sustained high CPU.
  4. If it’s calm, you’re done — the combination of rescheduled scans, exclusions, updates, and cleanup holds long-term.
  5. If high CPU returns, note exactly when (after updates? during specific apps?) and revisit Fix 1 — recurring patterns point at a specific trigger you haven’t excluded or scheduled yet, like the post-update Defender guide covers.

Closing

That’s the whole answer: check what Defender’s busy with, move scans to the night, exclude the folders it obsesses over, update the engine, clear old antivirus remnants, repair if needed, and verify. No registry hacks, no disabled protection, no “debloat” scripts that break things. Just a Defender that’s busy only when it should be — which is most of the time, quietly, in the background where it belongs.

Frequently asked questions

What is the quickest safe fix for MsMpEng.exe high CPU?
Add your busiest trusted folders to Defender’s exclusion list. Open Windows Security > Virus & threat protection > Manage settings > Exclusions, and add folders with constant file changes that you trust — game libraries, code projects, video caches. This single step resolves most persistent cases within a day because it stops the endless rescan loop that keeps the engine busy.
How do I check if Defender is running a scheduled scan right now?
Open Windows Security > Virus & threat protection > Protection history and look for recent scan entries with matching timestamps. Then open Task Scheduler, navigate to Task Scheduler Library > Microsoft > Windows > Windows Defender, and check the Last Run Time of the Windows Defender Scheduled Scan task. If the high CPU lines up with the schedule, rescheduling the scan to idle hours is the fix.
Will this keep happening after every Windows update?
It can spike after updates because Defender re-baselines with a broad scan and updates touch thousands of files that each get real-time scanned. This normally settles in 24 to 48 hours. If high CPU persists beyond that after every update, the underlying trigger is usually an excluded-worthy folder or a stuck scan schedule — fix the trigger once and updates stop causing prolonged episodes.
Is high MsMpEng.exe CPU a sign my PC is infected?
Rarely, but it’s worth ruling out. Check Protection history for quarantined threats or repeated detections of the same file — active threat remediation legitimately causes high CPU. If the history is clean and CPU is constantly high with no scan running, run a Microsoft Defender Offline scan to be thorough. In the large majority of cases, though, the cause is workload (churning folders, schedules), not malware.