Fix guides

Antimalware Service Executable using high CPU

This is Microsoft Defender, the antivirus built into Windows. A spike is usually a scan that finishes on its own.

Published October 13, 2026. Steps are for Windows 11 and 10.

What it is

Antimalware Service Executable is the name Task Manager gives MsMpEng.exe, the engine of Microsoft Defender Antivirus. It checks files as they're opened and written, and runs a regular quick scan.

It gets busy when lots of files change at once: right after a download or an install, while a game updates, while you unzip something big, or when developer tools write thousands of small files (node_modules, build folders). It also runs its regular scan during Windows' automatic maintenance.

Is it safe to end?

No. Windows protects it, and it's your antivirus, so turning it off isn't a good fix. Making it do less work is.

If it just started

Let it finish. A spike after a download or update usually settles within a few minutes. If you just installed another antivirus, make sure only one is doing real-time protection: Windows Security turns Defender's off automatically when another one is active.

Move the regular scan to when you're away

Defender's regular scan runs during automatic maintenance, which Windows starts when the PC is idle at a set time. If your PC is never idle then, it runs while you're using it. To change the time:

  1. Open Control Panel → System and Security → Security and Maintenance.
  2. Expand Maintenance and click Change maintenance settings.
  3. Pick a time when the PC is usually on but you're not using it.

Exclude folders you trust

If it's busy every time you build code or update games, exclude those folders from real-time scanning:

  1. Open Windows Security → Virus & threat protection.
  2. Under Virus & threat protection settings, click Manage settings.
  3. Scroll to Exclusions, click Add or remove exclusions, and add the folder.

Only exclude folders whose contents you trust, such as your own code projects. Never exclude Downloads or a whole drive. On Windows 11, a Dev Drive is a safer option for code: Defender scans it in a faster performance mode instead of not at all.

See it live on your PCKnow My PC recognises a Defender scan when it's the cause, says it'll finish on its own, and shows how long it's been running so you can tell a normal scan from one that never stops.
Try it free for 14 days