TechReview
How-To & Guides

MsMpEng.exe: What It Is, Why It Uses High CPU, and How to Fix It

Published By Shivam Sharma7 min read
MsMpEng.exe: What It Is, Why It Uses High CPU, and How to Fix It

If Task Manager shows Antimalware Service Executable eating your CPU, you are looking at MsMpEng.exe. They are the same thing: MsMpEng.exe is the file name, Antimalware Service Executable is the friendly name Windows shows you. It is Microsoft Defender’s own antivirus engine, not a virus in disguise. Usually, high CPU just means a scan is running. Let it finish or tame its schedule; do not delete it. Below: how to tell the real file from an imposter, why it spikes, and the fixes that work, in order.

What is MsMpEng.exe?

MsMpEng.exe is the engine behind Microsoft Defender Antivirus, the built-in protection in Windows 10 and 11. It scans files as you open or run them, runs scheduled scans, and applies definition updates about new threats. On a normal day it stays quiet and uses very little CPU.

The two names cause most of the confusion. On the Processes tab in Task Manager you see “Antimalware Service Executable.” Switch to the Details tab and the same process is listed as MsMpEng.exe. People search both names, land on different guides, and wonder if they have two problems. They do not: one process, two labels.

Is MsMpEng.exe safe?

The real file is safe. An imposter using the same name is not, so the first check is always location. Open Task Manager with Ctrl + Shift + Esc, go to Details, right-click MsMpEng.exe, and choose “Open file location.” A genuine copy lands in a Microsoft Defender folder: C:\Program Files\Windows Defender or C:\ProgramData\Microsoft\Windows Defender. Also check Properties, Digital Signatures tab, for Microsoft Corporation.

If the file turns up in Downloads, a temporary folder, or some unrelated application’s folder, treat it as suspicious. Run a full scan from Windows Security, under Virus & threat protection and then Scan options, and let Defender judge it. You can also upload that file to VirusTotal for a second opinion, but never download a “clean” replacement from a random website. That is exactly how an imposter arrives.

Read Also: BackgroundTaskHost.exe: What It Is, Why It Uses High CPU, and How to Fix It

Why is MsMpEng.exe using so much CPU?

The most common reason is the least alarming one: a scan is running. Open Windows Security, go to Virus & threat protection, and look under Current threats. If a scan started a few minutes ago, that is your answer, and the CPU should fall when it finishes. Scans also follow definition updates, and on startup or every few days Defender may run a full scan that keeps the machine busy for a while.

Real-time protection is the second cause. Every file you open, download, or launch gets scanned first, so anything that touches a lot of files keeps Defender busy: a large game library, virtual machine software, an attached external drive, or a folder full of project files. Outdated definitions make it worse, because Defender works harder when its intelligence is stale. A second security product installed alongside Defender can also make the two scan each other.

Memory follows the same pattern: it climbs during a scan and should fall when the scan ends. If CPU or memory stays high for hours after scans finish, work through the fixes below.

Read Also: Lsalso.exe: What It Is, Why It Uses High CPU, and How to Fix It

How do I fix MsMpEng.exe high CPU usage?

Work through these in order, and stop as soon as the problem clears. Most cases are solved by the first three.

  1. Let the scan finish. Check Windows Security, Virus & threat protection, for an active scan. If one is running, wait before changing settings.
  2. Update definitions and Windows, then restart. In Windows Security, check Protection updates, then check Windows Update and install anything offered. Restart when asked.
  3. Cap scan CPU with PowerShell. Open PowerShell as administrator and run Set-MpPreference -ScanAvgCPULoadFactor 30 and Set-MpPreference -EnableLowCpuPriority $true. The first limits scheduled scans to about 30 percent CPU on average; the second gives your apps priority over a scheduled scan. Two caveats from Microsoft’s own documentation: the cap is guidance, not a hard limit, so short peaks still happen, and manually started scans ignore it. Never use 0, because 0 turns throttling off, and a lower cap makes scans slower.
  4. Move scheduled scans to idle time. In Task Scheduler, under Task Scheduler Library, Microsoft, Windows, Windows Defender, change the triggers on Windows Defender Scheduled Scan so scans run when you are away.
  5. Exclude one trusted path, and only one. In Windows Security, under Virus & threat protection settings, use Add or remove exclusions for the exact folder of one trusted application that triggers constant scans. Microsoft generally recommends against exclusions, so treat this as a targeted exception, never a habit. Never exclude a whole drive or a file type.
  6. Sort out a second antivirus. Windows turns Defender off automatically when a compatible third-party antivirus is installed. If Defender still runs hot with another product present, update or reinstall that product from its vendor, or remove it properly. Two active scanners are a problem, not extra protection.
  7. Repair Windows files. In an administrator Command Prompt, run DISM first, then SFC: DISM.exe /Online /Cleanup-image /Restorehealth, wait for completion, then sfc /scannow until verification reaches 100 percent. This is Microsoft’s current order; older guides that reverse it are wrong.
  8. Run a full scan if the usage stays unexplained. From Scan options, run a Full scan: a hidden malware cause must be ruled out before you conclude it is a settings problem. Only if every step above fails, consider a Windows repair or reset that keeps your files.

Why can’t I stop MsMpEng.exe in Task Manager?

Because Windows is designed to stop you. The process belongs to the WinDefend service, and Microsoft warns against stopping it because that can make Windows unstable. Even if you end the task, Defender restarts it, so you get a gap in protection and the same CPU problem later.

The guard is Tamper Protection, on by default. It blocks malicious apps from changing important Defender settings, including real-time protection and cloud-delivered protection. An administrator can still change settings inside the Windows Security app, but other apps cannot, and switching Tamper Protection off puts a yellow warning in Windows Security. The real-time protection toggle is temporary too: Windows turns it back on soon after. None of this is a bug to work around. The fix is reducing the process’s load, not killing it.

Which Microsoft addresses does MsMpEng.exe connect to?

Defender talks to Microsoft for two jobs, and the addresses tell you which one. Cloud-delivered protection, which Microsoft calls MAPS, uses the wdcp.microsoft.com family, including wdcpalt.microsoft.com and wd.microsoft.com. Definition updates use the download.microsoft.com family, and product updates come through update.microsoft.com and windowsupdate.com. Microsoft lists these as required connectivity addresses, mostly on port 443.

That list matters practically: if a firewall blocks these addresses, cloud protection and definition updates fail, and update attempts can repeat. So MsMpEng.exe reaching out to a microsoft.com address is normal Defender traffic, not something to block. Administrators can verify the cloud connection with MpCmdRun.exe -ValidateMapsConnection; home users only need the rule: leave Microsoft’s own Defender addresses alone.

Read Also: Winword.exe: What It Is, Why It Uses High CPU, and How to Fix It

What not to do with MsMpEng.exe

Do not delete it: it is the antivirus engine itself, and deleting it leaves the PC without built-in protection. Do not permanently disable Defender unless another antivirus is installed. The real-time toggle re-enables itself, and the old DisableAntiSpyware registry value no longer works on current Windows, so registry tricks from old guides will waste your time. Do not download a replacement copy. That is how imposters spread. Do not exclude whole drives. One trusted path is the limit. Do not kill it in Task Manager. It comes back, and you were unprotected while it was gone.

Frequently asked questions

Is Antimalware Service Executable the same as MsMpEng.exe? Yes. Antimalware Service Executable is the display name in Task Manager’s Processes tab, and MsMpEng.exe is the file name in the Details tab. Same process.

Can I delete MsMpEng.exe? No, it is Microsoft Defender Antivirus itself. To get rid of Defender, install a compatible third-party antivirus first; Windows will turn Defender off on its own.

Why does MsMpEng.exe use so much RAM? Memory climbs during a scan and should fall when it ends. If it stays high long after scans finish, work through the fixes above; normal usage depends on what is being scanned, so no single RAM number applies.

Will MsMpEng.exe slow down my games? During a scan, yes. Cap scan CPU and move scheduled scans to idle hours; do not disable protection before gaming.

Sources

Related reviews and guides