MsMpEng.exe high CPU: what Microsoft Defender is doing and how to calm it

What MsMpEng.exe is

MsMpEng.exe is the Antimalware Service Executable, the engine of Microsoft Defender Antivirus. It performs real-time protection and scheduled scans, so some CPU use is its job. The question is whether the use is a scan that will finish, or something that should not be happening.

1. See what Defender is doing

Get-MpComputerStatus | Select-Object AMRunningMode, RealTimeProtectionEnabled,
  AntivirusSignatureLastUpdated, QuickScanEndTime, FullScanEndTime

AMRunningMode tells you whether Defender is the active antivirus. If another security product is installed, Defender normally steps back to passive mode and should be using little CPU; high use in that situation points at a conflict worth raising with whoever owns endpoint security.

Then measure the process the same way as any other, over several readings:

1..5 | ForEach-Object {
  Get-CimInstance Win32_PerfFormattedData_PerfProc_Process -Filter "Name='MsMpEng'" |
    Select-Object IDProcess, PercentProcessorTime
  Start-Sleep 2
}

2. Is a scan running, and how hard may it work?

Get-MpPreference | Select-Object ScanAvgCPULoadFactor, DisableCpuThrottleOnIdleScans,
  ScanScheduleDay, ScanScheduleQuickScanTime

ScanAvgCPULoadFactor is the average CPU a scan may use, as a percentage. Microsoft documents the default as 50. A scan scheduled in the middle of the working day is a common reason users complain.

3. Fixes, least invasive first

1. Let a running scan finish. On a freshly built or newly joined machine, the first scan is often long. If it ends, the symptom ends.
2. Move the scheduled scan to a quiet hour using the scan schedule settings, so it does not collide with the user.
3. Lower the scan CPU limit. This changes how long scans take, not whether they run.

# Changes a setting - record the current value first (step 2), then:
Set-MpPreference -ScanAvgCPULoadFactor 30

Do not turn off real-time protection to stop the symptom, and treat any exclusion as a security decision for whoever owns it: an excluded path is a path that is no longer scanned. If a specific application keeps triggering heavy scanning, find out which one before excluding anything.

4. Verify

Measure again over several minutes and ask the user whether the original complaint has gone. If Defender is high again only while one application runs, that application is the thing to investigate, not Defender.

Where RemediateDesk fits

RemediateDesk reads Defender's status and the scan settings as read-only checks, so the proposal is based on what the machine reports. Changing the scan limit or schedule is one exact command that waits for approval. Exclusions and turning protection off are never something it suggests on its own.

Frequently asked questions