What Is MsMpEng.exe and How to Fix High CPU Usage in Windows 11/10

“MsMpEng.exe is using 100% CPU” can make Windows crawl while Microsoft Defender scans files. If you’re hoping it’s a harmless Windows process, that’s promising: MsMpEng.exe is the legitimate engine behind Microsoft Defender Antivirus.

How to Fix MsMpEng.exe High CPU Usage

Fix #1: Check whether Microsoft Defender is running a scan

MsMpEng.exe appears as Antimalware Service Executable in Task Manager. High CPU use is expected during a full or scheduled scan, but it should drop after the scan finishes.

1. Press Ctrl + Shift + Esc. Task Manager should open.
2. Select Processes. You should see Antimalware Service Executable if Defender is active.
3. Open Windows Security from the Start menu. The security dashboard should appear.
4. Select Virus & threat protection. Any active scan should appear under Current threats.

5. Let the scan finish. MsMpEng.exe’s CPU use should fall within a few minutes.

A full scan can take much longer when it checks a large game library, virtual machine software, or an attached external hard drive. Continue with the next fix if CPU usage stays high after the scan ends.

Fix #2: Confirm that MsMpEng.exe is genuine

Malware can use familiar filenames to avoid attention. The real MsMpEng.exe runs from a protected Microsoft Defender folder.

1. Open Task Manager with Ctrl + Shift + Esc.
2. Select Details. You should find MsMpEng.exe in the process list.
3. Right-click MsMpEng.exe.
4. Select Open file location. File Explorer should open a Microsoft Defender directory.

A legitimate copy normally resides beneath C:\ProgramData\Microsoft\Windows Defender or C:\Program Files\Windows Defender. A file running from Downloads, a temporary directory, or an unrelated application folder needs investigation.

Open Windows Security > Virus & threat protection > Scan options, select Full scan, and choose Scan now if the location looks suspicious.

Fix #3: Update Microsoft Defender and restart Windows

Outdated or damaged security definitions can cause repeated scanning. Installing the current definitions gives Defender a clean threat database.

1. Open Windows Security.
2. Select Virus & threat protection.
3. Find Virus & threat protection updates.
4. Select Protection updates. The installed security intelligence version should appear.
5. Select Check for updates. Windows should download any available Defender updates.
6. Restart your PC. MsMpEng.exe should settle after the initial startup checks finish.

So far, so good if CPU use now drops to normal levels. If the process spikes whenever you open a specific folder or program, add a narrow exclusion next.

Fix #4: Exclude a trusted high-activity folder

Defender scans files when programs create, open, or modify them. Build-output folders, virtual machine images, and trusted game files can generate enough activity to keep MsMpEng.exe busy.

An exclusion reduces protection for that location. Use it only after identifying the affected workload, and remove it if testing shows no benefit. Only exclude a location when you trust every file inside it. I’d skip this step for Downloads, browser caches, your entire user profile, C:\Windows, and Defender’s own folders.

1. Open Windows Security.
2. Select Virus & threat protection.
3. Select Manage settings under Virus & threat protection settings.
4. Scroll to Exclusions.
5. Select Add or remove exclusions. Windows should request administrator approval.
6. Select Add an exclusion.
7. Choose Folder. A folder picker should open.
8. Select the trusted folder causing repeated scans.
9. Choose Select Folder. The path should appear in the exclusions list.

Test the same workload again. CPU use should be lower if repeated scanning of that folder caused the problem.

PowerShell also supports targeted exclusions. Open Terminal (Admin) and run Add-MpPreference -ExclusionPath "C:\Path\To\Folder", replacing the example with the trusted folder’s full path. Add-MpPreference appends an exclusion without replacing the existing list.

Fix #5: Move the scheduled scan to a quieter time

A scheduled Defender scan can start while you’re working, especially if the PC was turned off during its normal maintenance window. Task Scheduler lets you choose a better time without sacrificing real-time protection.

1. Open Start.
2. Search for Task Scheduler.
3. Select Run as administrator. Task Scheduler should open with elevated access.
4. Expand Task Scheduler Library > Microsoft > Windows > Windows Defender.
5. Double-click Windows Defender Scheduled Scan. Its properties window should open.
6. Select the Triggers tab.
7. Select the current scheduled trigger, or choose New if the list is empty.
8. Select Edit for an existing trigger. The trigger settings should appear.
9. Choose a day and time when the PC is usually on but idle.
10. Select OK.
11. Select OK again. The revised trigger should appear beside the task.

Keep the task enabled. Disabling scheduled scans can leave rarely accessed files unchecked for long periods.

Fix #6: Limit Defender’s scan CPU usage

Windows Pro and Enterprise editions include a Group Policy setting that caps Defender’s average CPU use during scans. A value between 30% and 50% is a sensible starting point.

This is an average CPU target, not a strict ceiling. It does not constrain every real-time protection spike, and idle scans can ignore it when CPU throttling for idle scans is disabled. See Microsoft’s scan settings guidance.

1. Press Windows + R. The Run dialog should open.
2. Type gpedit.msc.
3. Press Enter. The Local Group Policy Editor should open.
4. Go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Scan.

5. Double-click Specify the maximum percentage of CPU utilization during a scan. The policy window should open.
6. Select Enabled.
7. Enter 30 in the percentage field.
8. Select Apply.
9. Select OK. The policy should show Enabled in the Scan folder.
10. Restart Windows. Check the next scheduled scan to see whether the setting helps; idle-scan policies and centrally managed settings may override it.

Windows Home doesn’t include Local Group Policy Editor. Use scan scheduling and targeted exclusions instead.

Fix #7: Reset Microsoft Defender’s definitions

Reset the definitions if MsMpEng.exe keeps consuming CPU with no active scan. Windows will download a fresh set after removing the current files.

1. Open Start.
2. Search for Command Prompt.
3. Select Run as administrator. An elevated Command Prompt should open.
4. Run "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All. The command should report that the definitions were removed.
5. Open Windows Security.
6. Select Virus & threat protection.
7. Open Protection updates.
8. Select Check for updates. A fresh security intelligence package should download.
9. Restart the PC. Defender should rebuild its scanning data during startup.

Don’t delete files manually from Defender’s protected directories. Windows security services can block the deletion or leave protection in a damaged state.

Should You Remove MsMpEng.exe?

Don’t remove MsMpEng.exe or try to disable Microsoft Defender through old registry values. Windows protects the process, and deleting its files can damage the Windows Security integration.

A reputable third-party antivirus normally registers itself with Windows and takes over active antivirus duties. Defender may still perform limited checks, so replacing it solely to eliminate every MsMpEng.exe process is a poor trade.

Turning off Real-time protection from Windows Security > Virus & threat protection > Manage settings is temporary and leaves new files unchecked. Use it only during a controlled diagnostic test, then turn it back on immediately.

When the Fixes Don’t Work

Use Microsoft Process Monitor to identify files MsMpEng.exe repeatedly accesses, then exclude only a verified, trusted workload. On managed PCs, contact the administrator because Intune or domain policies can override local Defender settings.

If MsMpEng.exe runs from an unexpected directory or Defender reports recurring threats, disconnect the PC from the network and run a full scan. A second scan from a reputable security service is also worth trying.

Conclusion

Fix #1 usually resolves temporary MsMpEng.exe high CPU usage because the scan simply needs time to finish. Microsoft Defender remains a solid choice, but I recommend targeted exclusions and a scan CPU cap when heavy workloads trigger the problem repeatedly.