How to Fix High CPU or Memory Usage by MsMpEng.exe Antimalware Service Executable with WinDefend Windows Defender Antivirus Service

In this page, we are going to share some methods you can do to fix High CPU or Memory usage by MsMpEng.exe Antimalware Service Executable and keep your machine running smoothly.

Fix 1: Change Windows Defender’s scheduling properly.

For most user, the high memory usage caused by Antimalware Service Executable usually occurs when Windows Defender is running a full scan. You are able to fix this by scheduling the scans to take place at a time when you are less likely to feel the drain on your CPU.

• At the first step, you have to open the Start menu, then type “task scheduler.” Please click the top result to launch the program.

• In the navigation pane on the left, you need to double click Task Scheduler Library. Please continue to expand those folders and navigate to the destination: Library/Microsoft/Windows/Windows Defender.
• After you have opened the Windows Defender folder, you are able to double click Windows Defender Scheduled Scan which is located in the middle pane.

• The next step that you have to do is to click the Conditions tab, uncheck all options and click ok. This will be able to clear your scheduled scans.
• To protect your computer, it is very important to schedule several new scans, however you are able to do this in a way that will reduce the impact on your system’s performance. To do that, you have to double click Windows Defender Scheduled Scan, choose the Triggers tab and click New.
• Afterwards, you are able to make a new scan schedule which suits your needs, choosing options that strike the balance between protection and system efficiency. We suggest you to scans at least weekly at a time when you are going to be unlikely to notice the increased CPU or memory usage.
• Please repeat the process for the three remaining services: Windows Defender Cache Maintenance, Windows Defender Verification and Windows Defender Cleanup that found in the Library/Microsoft/Windows/Windows Defender folder.

Fix 2: Add Antimalware Service Executable (MsMpEng.exe) to Windows Defender exclusion list.

During its scans, usually Windows Defender checks every single file on your PC/computer including itself. Sometimes, this is able to result in several interesting interactions and this is a common source of system lag. To avoid this from happening, simply you are able to instruct Windows Defender to skip itself once doing a system scan.

• The first thing that you have to do is to press Ctrl + Shift + Esc to open Windows Task Manager.
• In the list of processes, you are able to search for Antimalware Service Executable. Please right click on the process and then choose Open File Location.

• In the address bar, you will be able to see the full path of Antimalware Service Executable. Simply, click on the address bar and copy the full path.
• After that, you have to open the Start menu, and then type “windows defender.” Click the top result to launch the Windows Defender Security Center.
• The next step that you have to do is to click on Virus & threat protection, then on Virus & threat protection settings.
• Please scroll down until Exclusions and click Add or remove exclusions. In the next screen, you have to click on Add an exclusion, choose Folder and paste the path to Antimalware Service Executable (MsMpEng.exe) in the address bar. lastly, click Open and the folder will be excluded from the scan now.

Fix 3: Disable Windows Defender

If the issue persists after applying the two fixes above, you may can try disabling Windows Defender. Please keep in mind that doing so makes you vulnerable to a range of cyberattacks, so it is very important for you to install an effective anti-malware product on your computer before disabling Windows Defender.

Disabling Windows Defender is able to help solving the problem because this was the only way which worked for many users. When you use this fix, once again we inform you that you have to install another antivirus because it will less likely consume less CPU time than Windows Defender. You will be able to use the Local Group Policy Editor for this. For note: It works on only Windows Enterprise and Pro Editions of Windows 10 and more advanced versions of earlier OS’s. If you cannot use the Local Group Policy Editor, so you are able to use the Registry Tweak below.

Using the Local Group Policy Editor

• At the first step, you have to press the Windows Key + R, then type in gpedit.msc in the Run dialog box. Next, click ok to open the Local Group Policy Editor.
• In the Local Group Policy Editor, you have to navigate to Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender.
• At this Group Policy path, you have to look for the setting called Turn off Windows Defender and double click it. Please choose the Enabled option to disable Windows Defender. Simply, click on Apply and ok to save the changes.

• Windows Defender should be disabled instantly. If it does not, you are able to restart the computer and check to see if it is disabled.

Usually, after doing that, Windows Defender will be disabled as well as Antimalware Service Executable. For note: It is worth mentioning that this solution will disable antivirus protection on your computer, so your computer will be vulnerable. In order to protect your computer, you have to use this fix only as a temporary solution.

Using the Registry

• At the first step, you have to press the Windows Key + R, then type in regedit in the Run dialog box. Simply, click OK to open the Windows Registry.
• In the Registry Editor, you have to  navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender.

• If you see a registry entry called Disable Anti Spyware, you have to double click to edit it and change its value to 1.
• If you do not discover the entry there, you are able to double-click on this registry file and apply it to your registry.

Fix 4: Check for virus or malware infections

It is possible that something more bad is causing Windows Defender to disturb your computer’s performance. In this case, you have to run a full system scan by using a reputable and lightweight anti-malware solution such as Emsisoft Anti-Malware to check your computer for any malware that can be affecting your computer’s ability to run smoothly and safely. There is a possibility that virus or malware has infected the MsMpEng.exe process. Now, try to scan with an anti-malware application like Emsisoft Anti-Malware, Malwarebytes and AdwCleaner to scan and remove any malware that can be present on your computer.

To remove Adware programs with AdwCleaner.

• If you want to remove adware programs with AdwCleaner, firstly you have to download and save AdwCleaner to your desktop. For your information, AdwCleaner is a great tool to scan and remove all the Adware, PUP, Toolbars, and Hijacker programs from your computer.
• After that, you have to close all open programs and then you are able to double Click to open AdwCleaner from your desktop.
• The next step that you have to do is to accept the License Agreement.
• After accepting the License Agreement, you need to press the Scan Now button.
• After the scan is completed, easily you are able to press Clean & Repair to remove all the unwanted malicious entries.
• When asked, you have to click Clean and Restart Now.
• After restart, you will be able to close AdwCleaner’s information (log) window.

Fix 6: Removing Bad Updates

Occasionally, Windows Defender gets bad definition updates and that causes it to determine certain Windows’ files as viruses or malware. So, in this fix, you will be able to  remove those updates by using Command Prompt. In order to do that, you are able to follow these steps below:

• At the first step, you have to press “Windows” + “R” keys simultaneously to open the run prompt.
• After that, you are able to type in “cmd” and press “Shift” + “Ctrl” + “Enter” simultaneously to give administrative privileges to the command prompt.
• Simply, click on “yes” in the prompt.
• Now, you need to type in the command below and press “Enter”

“%PROGRAMFILES%\Windows Defender\MPCMDRUN.exe” -RemoveDefinitions -All

• The next step that you have to do is to type in the command below and press “Enter”

“%PROGRAMFILES%\Windows Defender\MPCMDRUN.exe” -SignatureUpdate

• Lastly, you are able to wait for the process to be completed and check to view if the problem persists.

By doing some fixes described above, you will be able to take control of Antimalware Service Executable and keep your computer running at full speed.

Most common reasons for high CPU by Antimalware Service Executable.

Antimalware Service Executable is a name of msmpeng (msmpeng.exe) process that used by Windows Defender program. The service which associated with this program is the Windows Defender Service. Apparently, there are two most common reasons for it to be consuming high CPU usage. The first is the real-time feature that is constantly scanning files, connections and other related applications in real-time, that is what it is supposed to be doing (Protect In Real Time). The second is the Full Scan feature that may be scanning all files, once the computer wakes up from sleep or when it is connected to a network, or if it is scheduled to run daily.

The little to understand here is that when it is performing a complete scan, frequently your system will be able to get lagging, hanging and delayed access or response from your input/interactions with the system, as the CPU is Hijacked by Defender. You do not be afraid or lose patience here, instead allow it run and scan, please wait a few minutes and if there are many files, then it may take a few hours, so allow it runs and finish what it is doing for the sake of your protection, when it has completed, it is going to release the CPU and the usage will be able to drop down to its normal.

What is the msmpeng.exe Antimalware Service Executable?

For those who use Windows Defender to protect your computer, you are able to open up the Windows Task Manager (Ctrl + Shift + Esc or Start Menu > Task Manager). Then, you are able to scroll down through the list of background processes. Next, you are going to find a process named Antimalware Service Executable file (msmpeng.exe). This process offers Windows Defender to continuously monitor your PC/computer for potential threats and give the real-time protection against virus, malware and cyberattacks. But, at the same time, it is also able to be the cause of disproportionately high CPU or memory usage.

Another feature of Windows Defender that can be cause for slowing down the system is its Full Scan that do a comprehensive check of all files on your PC/computer. Full Scan very dependent on the CPU and is not afraid to utilize whatever resources your system has available. As a result, you may get delays, lag, hanging and other system disruptions once it is running. While it is normal for antivirus programs to consume system resources once running a scan, Windows Defender is far greedier than most. It is known to utilize the excessive CPU for longer periods of time and perform scans right when you wake up your computer to send an email or check a site quickly. Although this can be really frustrating, it is important that you do not disable Windows Defender without first installing another IT security solution. However, it may be the only thing which stands between your computer and the bad things. Allow the program do its job, resolve any threats and then you are able to follow some fixes above to prevent the problem from happening again.