What to Do When Antimalware Service Executable Uses High CPU

When Antimalware Service Executable starts hogging 40, 60, or even 80% of your processor in Task Manager, your whole laptop turns into a sluggish mess. Fans spin up, the battery drains fast, and even simple things like opening File Explorer feel delayed. I’ve seen this on machines that are otherwise healthy, which is why the problem is so frustrating — the thing slowing you down is the very program meant to protect you.

The good news: MsMpEng.exe high CPU is almost never a sign of a broken system. It is a known, well-documented behavior of Windows Security with a short list of well-understood causes. On most laptops, the fix takes under fifteen minutes and doesn’t require disabling your antivirus. The key is figuring out why it’s scanning so hard, because the right fix depends entirely on the cause.

Why this happens

• A full scan is running in the background — Windows Security schedules full scans automatically, and when one kicks off while you’re working, CPU usage spikes until it finishes.
• Real-time protection is scanning every file operation — on systems with slow drives or huge numbers of files being written, each file access triggers a scan cycle.
• Corrupt or outdated virus definitions — when definition files get corrupted, the engine can get stuck rescanning the same content repeatedly.
• A scheduled scan got interrupted — a scan that was paused by a reboot or sleep keeps resuming and never completes, creating a permanent high-usage state.
• Conflict with a third-party antivirus — two real-time engines scanning each other (and the same files) doubles the workload.
• The process is scanning its own history or quarantine folder — large scan history logs or a bloated quarantine folder make each scan take longer and work harder.
• Scanning inside large archives and backup folders — virtual machine images, Steam libraries, and backup folders contain gigabytes of compressed data that take serious CPU to inspect.

How to fix it

Work through these in order — diagnose first, then act.

Fix 1: Check whether a scan is actually running

Before changing anything, open Windows Security and look at what it’s doing. Go to Start → Settings → Privacy & security → Windows Security → Virus & threat protection and check the “Current threats” section. If a scan is in progress, that explains the spike — let it finish, and CPU should drop back to near zero. You can also check Protection history to see whether a recent scan found anything. For general Defender guidance, see Microsoft’s Windows security documentation .

Steps:

1. Press Win + I to open Settings.
2. Go to Privacy & security → Windows Security.
3. Click “Virus & threat protection.”
4. Look for any “Scan in progress” indicator or recent scan entries.
5. If a full scan is running, let it complete before applying the fixes below.

Fix 2: Reschedule full scans to idle time

The default scheduled scan can fire at bad times. Changing it to run when you aren’t using the laptop stops the CPU spikes during your workday.

Steps:

1. Open Task Scheduler (search for it in the Start menu).
2. Navigate to Task Scheduler Library → Microsoft → Windows → Windows Defender.
3. Right-click “Windows Defender Scheduled Scan” and choose Properties.
4. On the Triggers tab, click Edit and set the scan for a time the laptop is on but unused — late evening works well for most people.
5. On the Conditions tab, check “Start the task only if the computer is idle for” and set 10–15 minutes.
6. Click OK, then let the task run on the new schedule.

Fix 3: Add scan exclusions for heavy folders

Folders like virtual machine disks, game libraries, and large backups don’t need to be scanned constantly. Excluding them can cut MsMpEng.exe CPU usage dramatically.

Steps:

1. Go to Settings → Privacy & security → Windows Security → Virus & threat protection.
2. Click “Manage settings” under Virus & threat protection settings.
3. Scroll to “Exclusions” and click “Add or remove exclusions.”
4. Click “Add an exclusion” → Folder, and add folders like your Steam library, VM images, or backup directories.
5. Also add the folder C:\ProgramData\Microsoft\Windows Defender\Scans\History if it has grown very large.
6. Keep exclusions limited to folders you trust — never exclude your Downloads folder.

Fix 4: Clear the Windows Defender scan history

A bloated scan history database can cause the engine to churn. Clearing it is safe and forces a clean rebuild.

Steps:

1. Open File Explorer and enable hidden items (View → Show → Hidden items).
2. Navigate to C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service.
3. Delete the contents of this folder (not the folder itself).
4. Run a fresh quick scan from Windows Security to rebuild the history cleanly.
5. Monitor Task Manager for a day — CPU usage should normalize.

Fix 5: Update or reset virus definitions

Corrupted definition files are a classic cause of scanning loops. Forcing a fresh update often fixes it instantly.

Steps:

1. Open Windows Security → Virus & threat protection.
2. Under “Virus & threat protection updates,” click “Protection updates.”
3. Click “Check for updates” and let it download the latest definitions.
4. If the problem persists, open an elevated Command Prompt and run: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All then MpCmdRun.exe -SignatureUpdate.
5. Restart the laptop and observe MsMpEng.exe in Task Manager.

Fix 6: Resolve third-party antivirus conflicts

If you have another antivirus installed, make sure Windows Security isn’t fighting it. Two real-time engines scanning simultaneously is one of the biggest CPU multipliers.

Steps:

1. Go to Settings → Apps → Installed apps and check for any third-party antivirus.
2. If you want to keep it, make sure it is fully updated — modern AV products register with Windows Security Center and disable Defender’s real-time scanning automatically.
3. If you want Windows Security as your only protection, uninstall the third-party product using its official removal tool (standard uninstall often leaves behind real-time drivers).
4. Restart and confirm in Windows Security that “Real-time protection” is on with no conflict warnings.

Fix 7: Tune real-time protection for slow hardware

On older laptops, you can reduce how aggressively the engine scans without turning protection off.

Steps:

1. In Windows Security, go to Virus & threat protection → Manage settings.
2. Keep Real-time protection ON — don’t disable it.
3. Turn on “Automatic sample submission” to let cloud-based analysis offload some local work.
4. Enable “Cloud-delivered protection,” which shifts part of the scanning decision-making to Microsoft’s servers and reduces local CPU load.
5. If CPU still spikes, disable “Tamper protection” temporarily, lower the schedule priority in Task Scheduler to “Below normal,” then re-enable tamper protection.

Closing

Antimalware Service Executable high CPU is annoying, but it’s a symptom with a short list of fixable causes — a scheduled scan, a bloated history folder, or an antivirus conflict covers nearly every case I see. Work the fixes in order, and if you’re also seeing Defender-specific spikes on a Dell machine, our Dell high CPU Defender guide walks through brand-specific steps. If you need to pause protection briefly while testing, follow the safe method in our temporary Defender disable guide . You should never need to permanently disable protection to get your CPU back.

Frequently asked questions