How to fix high CPU usage caused by `Antimalware Service Executable` in Windows 11?

Run Microsoft Defender’s Performance Analyzer while the CPU spike is occurring, then tune the specific scan workload it identifies rather than disabling MsMpEng.exe or real-time protection. ^1^

1. Identify what Defender is repeatedly scanning

1. Right-click Start and select Terminal (Admin).
2. Start a recording:

New-MpPerformanceRecording -RecordTo "$env:USERPROFILE\Desktop\Defender-scans.etl"

3. Leave the window open and reproduce the high-CPU condition for a few minutes. If it primarily occurs at startup, start recording as soon as possible after signing in.
4. Press Enter to stop recording.
5. Generate a report:

Get-MpPerformanceReport `
  -Path "$env:USERPROFILE\Desktop\Defender-scans.etl" `
  -TopFiles 10 -TopExtensions 10 -TopProcesses 10 -TopScans 20

These commands require administrator privileges and report the files, extensions, processes, and scans having the greatest Defender performance impact. The analyzer is supported on Windows 11 with Defender platform version 4.18.2108.7 or later. ^2^

Look for:

• One application repeatedly creating or modifying many files.
• Large .iso, .vhd, or .vhdx files in Desktop, Downloads, Documents, OneDrive, or another synchronized location.
• Development/build folders containing rapidly changing files.
• A non-Microsoft security, monitoring, VPN, or endpoint application interacting with Defender.

Moving large disk-image files out of synchronized or redirected profile folders can reduce scanning latency without weakening protection. Conflicts involving other security software should be addressed using the software vendor’s documented Defender configuration. ^3^

2. Reduce scheduled-scan CPU usage safely

If the spike is from a scheduled scan, use an average target such as 20–30% and low CPU priority. In an elevated PowerShell window, run:

Set-MpPreference -ScanAvgCPULoadFactor 25
Set-MpPreference -EnableLowCpuPriority $true
Set-MpPreference -DisableCpuThrottleOnIdleScans $false
Get-MpPreference | Select-Object ScanAvgCPULoadFactor,
    EnableLowCpuPriority, DisableCpuThrottleOnIdleScans

The CPU value is guidance to the scanning engine, not a hard cap. Lower values leave more resources for other work but make scans take longer. The default CPU target is 50; valid values are 5–100, while 0 disables throttling. DisableCpuThrottleOnIdleScans defaults to true, which can explain aggressive scanning while Windows considers the PC idle, including around startup. ^4^ ^5^

These controls primarily affect scheduled scans. Manual scans can ignore throttling unless the corresponding scan policy is changed. ^6^

3. Add an exclusion only when the report identifies a trusted target

If the analyzer consistently identifies a trusted application folder—for example, a game installation or build-output/cache directory:

1. Open Windows Security.
2. Select Virus & threat protection.
3. Under Virus & threat protection settings, select Manage settings.
4. Under Exclusions, select Add or remove exclusions.
5. Select Add an exclusion, then add the smallest applicable file, folder, or process.

Avoid excluding an entire drive, user profile, Downloads folder, file type, or MsMpEng.exe. Prefer the full executable path for a process exclusion. Exclusions stop applicable real-time checks and reduce protection; scheduled scans or third-party antimalware might still scan the target. ^7^

If the analyzer does not identify the cause

• Run Process Monitor next for process-level detail; Microsoft recommends it after the Defender analyzer fails to isolate the trigger. ^8^
• Repair Windows components from Terminal (Admin):

DISM.exe /Online /Cleanup-image /Restorehealth
sfc /scannow

Restart after both commands complete. These checks address damaged Windows components; they do not replace the scan-performance investigation. ^9^

Do not permanently disable real-time protection, behavior monitoring, or tamper protection. Real-time protection scans accessed or executed files and automatically turns itself back on after temporary UI-based disabling; a narrow, verified exclusion is safer than disabling antivirus protection globally. ^7^

References

1. Performance analyzer for Microsoft Defender Antivirus
2. Microsoft Defender Antivirus Performance Analyzer reference
3. Troubleshoot performance issues related to real-time protection
4. Schedule antivirus scans using PowerShell
5. Troubleshoot Microsoft Defender Antivirus scan issues
6. Microsoft Defender Antivirus full scan considerations and best practices
7. Virus and Threat Protection in the Windows Security App | Microsoft Support
8. Troubleshoot Microsoft Defender Antivirus performance issues with Process Monitor
9. [Windows 11](https://support.microsoft.com/windows/deployment/updates-lifecycle/troubleshoot-problems-updating-windows#repair-hard-drive-errors)