Windows Defender consuming 40% CPU even though folders are excluded

Foo Yuen 20 Reputation points
2025-10-21T03:59:19.32+00:00

Hi,

We have a VM where MS Defender has already been turned off, and we had also configured folders to be excluded from scanning. But the Windows Performance Monitor still showed the MsMpEng process consuming 40% CPU at 8am this morning. At other times, the process consumes little or no CPU.

User's image

User's image

Can you advise? Thank you.

Microsoft Security | Microsoft Defender | Microsoft Defender for Cloud
{count} votes

1 answer

Sort by: Most helpful
  1. Himanshu Shekhar 1,350 Reputation points Microsoft External Staff Moderator
    2025-10-21T05:29:34.9133333+00:00

    Hello @Foo Yuen

    Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

    Based on investigation we can suggest detailed lists below:

    Please confirm that the Defender Scheduled Scan task is disabled if you don't wish to scan it.

    Common reasons for higher CPU utilization by Microsoft Defender Antivirus : https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-performance-issues#common-reasons-for-higher-cpu-utilization-by-microsoft-defender-antivirus

    Now check in PowerShell for exclusions (Set-MpPreference) and let's confirm all the necessary folders, extensions, or processes are excluded also refer the detailed suggestions from Microsoft : https://learn.microsoft.com/en-us/defender-endpoint/configure-exclusions-microsoft-defender-antivirus

    High CPU usage due to Windows Defender (MsMpEng.exe) : https://learn.microsoft.com/en-us/defender-endpoint/troubleshooting-mode-scenarios#scenario-2-high-cpu-usage-due-to-windows-defender-msmpengexe

    Please Run Process Monitor (ProcMon) during these spikes to see which files or folders the service is accessing, then add targeted exclusions.

    For troubleshooting performance issues related to real-time protection : https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-performance-issues

    Kindly let us know if the suggested steps helps or you need further assistance on this issue.

    Regards

    Himanshu


Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.