How to Stop Antimalware Service Executable High CPU

If your computer suddenly gets loud, hot, or sluggish and Task Manager shows Antimalware Service Executable at the top, you are not alone. This process is part of Microsoft Defender, but when it uses too much CPU for too long, everyday tasks can feel painfully slow. In this guide, you will learn how to lower Antimalware Service Executable high CPU usage safely without leaving your PC unprotected.

Why this happens

Antimalware Service Executable, also known as MsMpEng.exe, is the background process used by Microsoft Defender Antivirus. It checks files when you open them, scans downloads, and runs scheduled scans to protect your system from malware. Short bursts of CPU activity are normal, especially after a Windows update, when new files are added, or when a full scan starts.

The problem starts when the process keeps using a large amount of CPU for an extended time. Common causes include overlapping scans, a corrupted Defender definition update, another antivirus conflicting with Defender, large compressed folders being scanned repeatedly, or scheduled scans running during work hours. In some cases, older PCs simply feel the impact more because they have less processing headroom.

Fix it step by step

1. Confirm that Defender is really the cause.
   Press Ctrl + Shift + Esc to open Task Manager, then click Processes or Details. Look for Antimalware Service Executable or MsMpEng.exe. If CPU usage spikes briefly and then drops, that is usually normal. If it stays high for 10 to 15 minutes or more while your PC is idle, continue with the next steps.
2. Let the current scan finish, then restart your PC.
   Defender may be in the middle of a legitimate scan. Wait a few minutes to see whether usage falls on its own. If it does not, restart Windows. A reboot clears temporary stuck processes and can stop a scan loop caused by a failed update or locked file.
3. Check Windows Security for scan status and update Defender.
   Open Start > Windows Security > Virus & threat protection. See whether a scan is running or whether protection updates are pending. Click Protection updates and install the latest intelligence update. Then go to Windows Update and install any pending system updates. Outdated definitions or partially installed updates are a common reason for Windows Defender high CPU usage.
4. Schedule scans for a time when you are not using the PC.
   Open Task Scheduler, then go to Task Scheduler Library > Microsoft > Windows > Windows Defender. Open the scheduled scan task and review the trigger time. Move it to a period when the computer is on but not busy, such as lunch or overnight. This does not disable protection; it simply reduces the chance that a full scan competes with your work.
5. Add an exclusion for large, trusted work folders if they are being scanned repeatedly.
   In Windows Security > Virus & threat protection > Manage settings > Exclusions, add only folders you know are safe, such as a large local archive of videos or development output files that change constantly. Avoid excluding Downloads, email folders, or anything you receive from other people. Done carefully, this can reduce repeated file checks and lower Antimalware Service Executable high CPU usage.
6. Look for antivirus conflicts.
   If you recently installed another antivirus or security suite, it may be overlapping with Defender. Open Settings > Apps and review installed security tools. Two real-time antivirus products running together can create constant scanning activity. If you use a third-party antivirus, make sure it is fully installed and updated so Windows can properly hand off protection duties. If you no longer need it, uninstall it using the vendor's normal uninstaller and restart.
7. Run a System File Check if the problem started after an update.
   Open Command Prompt as administrator and run sfc /scannow. This checks Windows system files and repairs common corruption. After it finishes, restart your computer. If Defender components were damaged by an interrupted update, this can help restore normal behavior.
8. Perform an offline malware scan if CPU usage is extreme and persistent.
   Sometimes malware tries to trigger or interfere with security scanning. In Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan. Save your work first, because your PC will restart. This deeper scan runs before Windows fully loads and can catch threats that are hard to remove during normal startup.

If the problem keeps coming back

If Antimalware Service Executable high CPU returns every day, the root cause may be a scheduled task, a damaged update, a third-party security conflict, or a specific folder that is constantly changing and being rescanned. Keep notes on when it happens, what apps are open, and whether it starts after updates or backups. That pattern makes it much easier to pinpoint the trigger and fix it without weakening your security.

Frequently asked questions

Is Antimalware Service Executable a virus?

No. Antimalware Service Executable is a legitimate Microsoft Defender process in Windows. Its file name is commonly shown as MsMpEng.exe. However, if you see a similar name in an unusual location or linked to suspicious behavior, run a full security scan to be safe.

Can I disable Microsoft Defender to stop high CPU usage?

It is not a good idea to disable your antivirus just to improve performance. Real-time protection helps block malware, ransomware, and unsafe downloads. Instead, use safer fixes such as updating Defender, adjusting scan timing, removing antivirus conflicts, or excluding only trusted high-churn folders when appropriate.

Why does Defender use more CPU after Windows updates?

After major updates, Defender may rescan system files, rebuild its cache, or install new security intelligence. That can temporarily increase CPU usage. If the activity settles down after the update completes and a restart, it is usually normal. If it stays high for hours, use the troubleshooting steps above.

Need help tracking down repeated slowdowns or fixing Antimalware Service Executable high CPU safely? Call 247TechTeam at 888-549-0702 or request a secure remote session.