PROCESSMicrosoft-signed
MsMpEng.exeAntimalware Service Executable (Microsoft Defender)
Antimalware Service Executable, the process MsMpEng.exe, is the core engine of Microsoft Defender Antivirus. It performs real-time protection and scheduled scans, which is why it uses CPU and disk, sometimes heavily during a full scan. You can reduce its impact by scheduling scans and adding sensible exclusions, but disabling it removes built-in protection.
What it does
Antimalware Service Executable (MsMpEng.exe) is the working process of Microsoft Defender Antivirus, the protection built into Windows. It does two main jobs:
- Real-time protection: inspecting files and processes as they are opened, written, downloaded or executed, and blocking known threats.
- Scheduled and on-demand scans: periodically examining the disk for malware.
Both are inherently CPU- and disk-intensive because they involve reading and analysing files.
Why usage spikes
- A scheduled full scan reads much of the disk; expect sustained CPU and disk for the duration.
- Real-time protection activates whenever files are touched, so extracting an archive, copying a large folder, compiling code or downloading a big file all trigger it.
- A recursive situation, where Defender scans the activity of another security tool that in turn scans Defender, can pin the CPU.
Reducing its impact safely
- Schedule full scans for idle time (Task Scheduler → Microsoft → Windows → Windows Defender → Windows Defender Scheduled Scan).
- Add exclusions for large, trusted, high-churn folders: source-code build outputs, virtual-machine disk images, big media libraries, database data directories. Exclusions reduce scanning but also reduce coverage, so scope them narrowly.
- Avoid running two antivirus products. A second real-time scanner and Defender end up scanning each other. Either rely on Defender or fully install one replacement, not both.
- Keep Windows and the security intelligence updated; performance fixes ship regularly.
Do not attempt to kill MsMpEng.exe with taskkill; Tamper Protection and the service manager restart it, by design.
Confirming it is genuine
The real MsMpEng.exe runs from a versioned folder under C:\ProgramData\Microsoft\Windows Defender\Platform\ and is signed by Microsoft. Use Task Manager's Open file location to confirm, since the path changes with each platform update. Heavy but temporary CPU here is the antivirus doing its job; sustained load also warrants checking your CPU temperature if the fan is constantly running.
Frequently asked questions
Why is Antimalware Service Executable using high CPU?
It is scanning: either a scheduled full scan, or real-time protection inspecting files as they are opened, copied or downloaded. Heavy activity during a full scan or a large file operation is normal and temporary. Persistent high CPU can be caused by Defender scanning its own or another security product's activity in a loop.
How do I reduce its CPU use without turning off protection?
Schedule full scans for a time you are not using the PC, add exclusions for large trusted folders (development build directories, VM images, media libraries), and make sure no second antivirus is running alongside it, which causes each to scan the other.
Can I disable it?
Not directly; Defender restarts it, and Tamper Protection prevents casual disabling for good reason. Installing another reputable antivirus makes Defender step aside automatically. Leaving a machine with no antivirus is not advisable.