Upgraded to Windows 11 24H2 and now Antimalware Service Executable (MsMpEng.exe) is eating your CPU alive? You’re not imagining it — but the culprit usually isn’t 24H2 itself. Feature upgrades trigger Defender’s heaviest workload: re-baselining tens of thousands of changed system files, catching up on missed scheduled scans, and re-scanning your busiest folders. 24H2’s larger-than-usual system changes make that initial storm a bit fiercer, and if the upgrade was interrupted or definitions lagged behind, Defender can get stuck in a high-CPU loop that doesn’t resolve on its own.

This guide is 24H2-focused: what the upgrade does to Defender’s workload, how to tell normal post-upgrade scanning from a stuck state, and the fixes that work on 24H2’s Defender platform — scheduling, exclusions, definition repair, and platform fixes. No registry hacks, no disabling protection. Start by checking Windows Security > Virus & threat protection > Protection history for scan activity timestamps — scans clustered right after your 24H2 install date confirm the upgrade-triggered pattern. For the general (non-24H2) guide, see taming Antimalware Service Executable ; for broader 24H2 slowness, see laptop slow after the 24H2 update .

Why this happens

  • 24H2 upgrade re-baseline: The feature upgrade replaces huge parts of the OS; Defender scans it all.
  • Missed scan backlog: Scans skipped during the upgrade’s multiple reboots queue up afterward.
  • Stale Defender platform post-upgrade: The antimalware platform sometimes lags the OS upgrade, scanning inefficiently until updated.
  • Re-scanning high-churn folders: Developer, gaming, and sync folders get re-examined file-by-file after the upgrade.
  • Corrupted Defender state from upgrade: Interrupted or problematic 24H2 installs can damage Defender’s configuration.
  • Conflicting security software remnants: Old third-party AV filter drivers clash with Defender’s 24H2 platform.
  • Genuine threat detection: The deep post-upgrade sweep occasionally finds real malware — check Protection history.

How to fix it

Work through these in order — diagnose first, then act.

Fix 1: Verify the 24H2 timeline and let the baseline finish

Confirm the story before intervening.

  1. Check Settings > System > About — confirm Version 24H2 and note the install date (Settings > Windows Update > Update history).
  2. Open Windows Security > Virus & threat protection > Protection history — scans timestamped in the days after the 24H2 install confirm upgrade-triggered scanning.
  3. Give it 24–48 hours of plugged-in use with some idle time — the re-baseline is heaviest in the first day and tapers.
  4. Watch the trend in Task Manager, not just the snapshot: declining CPU over hours means it’s finishing; a flat high line means it’s stuck.
  5. If you’re past 48 hours with no improvement, the upgrade isn’t the whole story — continue to the active fixes.

Fix 2: Bring the Defender platform fully up to date on 24H2

The platform must match the OS.

  1. Run Settings > Windows Update > Check for updates repeatedly until nothing remains — Defender platform and Security Intelligence updates ship separately from OS patches and often lag the 24H2 upgrade.
  2. Then open Windows Security > Virus & threat protection > Protection updates > Check for updates to force the latest definitions.
  3. Verify versions: Windows Security > Settings (gear icon) > About shows the antimalware platform and engine versions — compare against Microsoft’s published current versions if CPU stays high.
  4. If updates fail or stall, run the Windows Update troubleshooter (Settings > System > Troubleshoot > Other troubleshooters).
  5. A fully updated Defender platform on 24H2 scans measurably more efficiently than a stale one — this single step resolves many “24H2 broke Defender” reports. See Microsoft’s Windows support pages for update troubleshooting.

Fix 3: Reschedule scans for idle hours

Move Defender’s heavy work off your work hours.

  1. Open Task Scheduler (taskschd.msc) > Task Scheduler Library > Microsoft > Windows > Windows Defender.
  2. Open Windows Defender Scheduled Scan > Properties > Triggers and set a 3 AM (or away-time) schedule.
  3. Under Conditions, enable Start the task only if the computer is idle and Stop if the computer ceases to be idle.
  4. Enable Run task as soon as possible after a scheduled start is missed so upgrade-backlogged scans clear overnight.
  5. Keep Wake the computer to run this task off unless you want guaranteed overnight completion — your call based on whether the laptop sleeps plugged in.

Fix 4: Add 24H2-era exclusions for your workload

Target the folders 24H2’s Defender keeps re-examining.

  1. Go to Windows Security > Virus & threat protection > Manage settings > Exclusions > Add or remove exclusions.
  2. Add Folder exclusions for trusted high-churn locations: code workspaces and build outputs, game libraries (Steam/Epic), video scratch disks, VM images, and local AI model folders (increasingly common and huge on 24H2 machines).
  3. Add Process exclusions for your compiler toolchain, IDE, or backup software if those drive the spikes.
  4. Keep exclusions narrow and trusted — never Downloads, Temp, or system directories. 24H2’s tightened SmartScreen and Defender integration assume those stay covered.
  5. Reassess after a day of normal work — Task Manager should show MsMpEng.exe spiking briefly on new files, not camping at high CPU.

Fix 5: Repair Defender’s platform on 24H2

For a Defender that seems damaged rather than busy.

  1. In an elevated terminal, run DISM /Online /Cleanup-Image /RestoreHealth followed by sfc /scannow — this repairs Windows components including Defender’s platform files.
  2. Check Windows Security > Virus & threat protection for any “actions needed” banners — unresolved states keep the engine churning.
  3. If you ever had third-party antivirus, run that vendor’s official removal tool (not just the uninstaller) — leftover filter drivers are a notorious cause of Defender loops after feature upgrades.
  4. Review Event Viewer > Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational for repeated error entries — error codes here point to the specific broken piece.
  5. As a brief diagnostic, toggle Real-time protection off for 10 minutes to confirm MsMpEng.exe is the true consumer — tamper protection re-enables it automatically.

Fix 6: Check 24H2-specific background interactions

Other 24H2 changes can amplify Defender’s load.

  1. Recall/Copilot+ features (on supported hardware): the continuous screenshotting writes constantly to disk — if enabled, its snapshot folder gets real-time scanned. Consider excluding the Recall snapshot location or disabling Recall if you don’t use it.
  2. Windows Studio Effects / enhanced search: 24H2’s expanded indexing of new content types keeps the indexer busy, and Defender scans what the indexer touches — if the indexer is the root hog, see our search indexer fix .
  3. Review Task Manager > Startup apps for new 24H2-era entries (AI helpers, widgets) adding background file activity.
  4. If you use Dev Drive (ReFS), confirm it’s configured — Dev Drives get performance-mode Defender treatment automatically, which is the ideal setup for build folders.
  5. After addressing these, give the system one full idle night — 24H2’s background optimization passes need uninterrupted time to settle.

Fix 7: The deliberate alternatives (not disabling)

If Defender and your workflow fundamentally clash on 24H2.

  1. Don’t use registry “disable Defender” hacks marketed for 24H2 — tamper protection neuters most of them, and the ones that work leave you silently unprotected.
  2. The legitimate path is a reputable third-party antivirus that registers with Windows Security Center — Windows then stands Defender down cleanly, which is completely different from breaking it.
  3. Before switching, run Microsoft Defender Offline scan to rule out malware as the true cause of the high CPU.
  4. If you manage many machines, Group Policy/MDM controls for Defender scheduling are the enterprise-grade answer — not per-machine hacks.
  5. Whatever you choose, keep Tamper Protection on and keep definitions updating — an unprotected or stale 24H2 machine is worse than a busy Defender.

Closing

High MsMpEng.exe CPU on Windows 11 24H2 is overwhelmingly an upgrade-aftermath problem: re-baseline scanning, stale platform components, and backlogged schedules — not a flaw in 24H2 itself. Update the platform, reschedule the scans, exclude your busy folders, and give it an idle night. The storm passes, and Defender goes back to being the quiet guardian it’s supposed to be.

Frequently asked questions

Does Windows 11 24H2 make Defender use more CPU?
24H2 itself does not inherently raise Defender CPU usage, but the upgrade to 24H2 triggers the same heavy re-baseline scanning as any feature update, and 24H2’s reworked update stack can leave Defender mid-migration if the install was interrupted. Most reports of high MsMpEng.exe CPU on 24H2 trace to post-upgrade scanning, stale definitions, or high-churn folders being rescanned — all fixable without touching 24H2-specific settings.
Can I roll back from 24H2 to fix the CPU issue?
Rolling back the entire OS is overkill for a Defender CPU problem and is only available for ten days after the upgrade anyway. The high CPU is almost never caused by 24H2’s core changes, so a rollback rarely helps and costs you security improvements. Fix Defender directly through scan scheduling, exclusions, and platform repair — those resolve the issue while keeping you on the supported release.
Where are Defender's scan settings in 24H2?
Unchanged from earlier Windows 11 releases: Windows Security, then Virus and threat protection, then Manage settings for real-time protection and exclusions, and Task Scheduler under Microsoft, Windows, Windows Defender for the scheduled scan timing. 24H2 did not move these. Tamper Protection still guards the settings, so legitimate changes through these interfaces are the supported path.
Is it safe to disable Defender on 24H2?
No. Disabling Defender removes real-time protection, and 24H2’s tamper protection will fight manual disabling attempts and re-enable it. Registry hacks marketed as 24H2 Defender disablers risk breaking Windows Security and future updates. If Defender fundamentally conflicts with your workflow, install a reputable third-party antivirus that registers properly with Windows Security Center instead of crippling the built-in protection.