Fix Antimalware Service Executable High CPU Without Disabling Defender

Antimalware Service Executable is the core process of Windows Defender, usually named MsMpEng.exe. It handles real-time protection, file scanning, and scheduled security checks. Occasional CPU spikes are normal, but if it keeps the CPU busy for a long time, startup, games, builds, decompression, and video editing can all become noticeably slower.

When this happens, do not make permanently disabling Windows Defender your first step. A safer approach is to find out why CPU usage is high, then fix the specific trigger. Very few cases truly require turning off protection, and if you do, you need an alternative security plan.

Quick Answer

If Antimalware Service Executable briefly uses a lot of CPU after startup, an update, extraction, or a build, let the scan finish. If the spike lasts or returns with the same workload, identify the folder causing heavy file activity, move scheduled scans outside working hours, and consider a narrowly scoped exclusion only for a trusted, reproducible cache or build directory. Do not exclude Downloads, temporary folders, or an entire drive, and do not permanently disable Microsoft Defender just to reduce CPU usage.

Match the Symptom to the Next Check

First Check Whether It Is Normal Scanning

Open Task Manager. If Antimalware Service Executable uses CPU for a short period, watch it for a few minutes first. These situations commonly trigger scans:

• Right after startup;
• After a Windows update;
• Downloading or extracting many files;
• Opening a large code repository;
• Building a project or generating many temporary files;
• Games, editing software, or virtual machines frequently reading and writing cache;
• Defender running a scheduled scan.

If CPU usage lasts only briefly and then returns to normal, you usually do not need to do anything. The cases worth optimizing are long-running high usage, or repeated freezes whenever you open a specific folder or application.

Method 1: Adjust the Windows Defender Scheduled Scan

If high CPU usage often appears at fixed times, such as after startup, during lunch, or when the PC is idle, it may be caused by a scheduled scan.

You can adjust it like this:

1. Press Win + S, search for and open “Task Scheduler.”
2. Expand “Task Scheduler Library > Microsoft > Windows > Windows Defender.”
3. Find Windows Defender Scheduled Scan.
4. Right-click it and open “Properties.”
5. In “Triggers,” move the scan time to a period when you rarely use the computer.
6. In “Conditions,” disable wake or idle triggers that you do not need.

Do not delete Defender’s scheduled task directly. It is better to move scanning to a time when you are not using the PC. That reduces stutter while keeping basic security checks.

Method 2: Add Exclusions for High-Write Directories

If Defender spikes every time you open a project, game, virtual machine, or editing cache, consider adding exclusions.

Good candidates are usually directories like:

• Local code repositories, such as large node_modules, build directories, or cache directories;
• Game installation directories or shader caches;
• Video editing caches, proxy files, and export caches;
• Virtual machine disk file directories;
• Large trusted datasets.

The path is:

1. Press Win + I to open “Settings.”
2. Go to “Privacy & security > Windows Security.”
3. Click “Open Windows Security.”
4. Go to “Virus & threat protection.”
5. Under “Virus & threat protection settings,” click “Manage settings.”
6. Scroll to the bottom and open “Add or remove exclusions.”
7. Click “Add an exclusion,” then choose a folder or file type.

Be careful: more exclusions are not better. Only exclude large directories that you trust, clearly understand, and know are read or written frequently. Do not casually exclude Downloads, Desktop, browser cache, or temporary folders, because unknown files are more likely to appear there.

Do not exclude the entire system drive. That severely weakens real-time protection and carries high risk.

Method 3: Avoid Defender Scanning Itself in a Loop

Sometimes Defender may repeatedly scan its own activity or security software logs, causing a scanning loop. Instead of disabling all protection, the safer choice is to add only the necessary process or folder exclusion.

The common approach is to check what Defender is scanning during the high-CPU period. If Resource Monitor, Event Viewer, or Windows Security shows a specific path, exclude only that confirmed trusted directory.

Do not blindly copy long exclusion lists from the internet. Many lists exclude critical system folders, Downloads, and script directories. That may reduce CPU usage in the short term, but it also lowers protection quality.

Method 4: Update, Repair, or Reset Defender State

If high CPU usage is not triggered by one specific directory and remains abnormal, try basic repair steps first:

• Check Windows Update and install the latest security intelligence and system patches;
• Restart the computer to rule out a stuck scan task;
• Run a quick scan in Windows Security;
• Check whether multiple antivirus tools are installed and scanning each other;
• Clean unusually large temporary files and build caches;
• Check whether the disk is nearly full or has bad blocks.

In many cases, Defender itself is not broken. A directory may simply be generating many new files continuously. Build caches, log files, virtual machine images, and sync conflicts can all make real-time protection scan again and again.

Not Recommended: Permanently Disable Windows Defender

Disabling Windows Defender through Group Policy can indeed stop Antimalware Service Executable from using CPU, but it is not a recommended routine fix.

The reason is simple: it solves the CPU issue by also removing the system’s basic protection. For ordinary users, the risk usually outweighs the benefit. A computer that often downloads software, opens archives, uses browser extensions, runs scripts, or receives unknown files should not run without protection.

Only consider disabling built-in protection in situations like:

• You have already installed and enabled reliable third-party security software;
• The PC is in a controlled environment, such as an offline test machine, virtual machine, or temporary build machine;
• You clearly understand the risk of disabling protection;
• Disabling it is only for short-term troubleshooting, not the long-term default.

If your goal is only to reduce CPU usage, adjust scan timing and exclude specific trusted directories first instead of disabling all protection.

Practical Troubleshooting Order

Use this order:

1. Check whether it is only a short normal scan.
2. Recall whether high CPU usage is tied to startup, updates, builds, games, editing, or decompression.
3. Adjust the trigger time of Windows Defender Scheduled Scan.
4. Add exclusions only for trusted large project or cache directories.
5. Update Windows and Defender security intelligence.
6. Check whether multiple antivirus tools are scanning each other.
7. If it is still abnormal, consider system repair or temporarily disabling protection for comparison testing.

How to confirm if Defender is scanning

After you see an increase in usage for this process in Task Manager, observe the disk activity and when it occurs. If you happen to be decompressing dependencies, building projects, downloading a large number of files, or synchronizing network disks, new files are often checked in real time. You can also view recent scan, update, or protection history in Windows Security Center to see if there are any tasks that fail repeatedly.

If high usage occurs randomly during idle periods and persists for a long time, first complete a system update, reboot, and run an on-demand scan. When security alerts, unknown processes, or abnormal network activities occur frequently, performance issues should give way to security troubleshooting, and you should not rush to add exclusions.

Which directories can be considered for minimal exclusion?

Exclusion will only be considered if “the source is credible, the content is reproducible, and it is indeed read and written frequently”. Examples include known language pack caches, build outputs, virtual machine images, or team-controlled dependency caches. Before excluding, make sure there are no downloaded files, email attachments, or third-party scripts mixed in the directory.

Adding should be done in a real build to verify CPU improvement; if no effect is found, undo it rather than continuing to expand the exclusion scope.

Scheduled scanning and development load

Schedule scheduled scans during a time period when no compilation or backup is required. For continuous integration, container or virtual machine workloads, prioritize heavy tasks at predictable times and allow for scan completion windows. This is more stable than turning off real-time protection, and can also reduce the feeling of “stuck every time you work”.

When further processing is required

If high Defender usage is accompanied by failed updates, frequent crashes, inability to turn on protection, disk errors, or repeated reports of the same threat, you should first check the system health and security logs and use official support channels if necessary. Don’t download so-called “Defender One-Click Shutdown/Repair Tools”; such tools can themselves be a source of risk.

FAQ: Is it safe to exclude Node_modules?

There is no single answer. It contains a large number of files and does affect build speed, but may also introduce new packages with the installation. Minimum scope exclusions for specific trusted items should only be considered when provenance, lock files, and supply chain management are all controllable.

FAQ: How much CPU usage is considered abnormal?

High occupancy for a short period of time is not necessarily abnormal. What matters more is the duration, whether it triggers every time, whether it affects work, and whether it is accompanied by security or system errors.

Conclusion

High CPU usage from Antimalware Service Executable is most commonly caused by Defender scanning many files, build caches, virtual machine images, or scheduled tasks. The reliable fix is not to immediately turn off Windows Defender, but to find the triggering path, adjust the scan schedule, and add exclusions for trusted high-frequency read/write directories.

If you only want the PC to stop freezing, start with exclusions and scheduled task adjustments. If you truly need to disable Defender, prepare alternative security software first and understand that it reduces system protection.