Your Fan Is Screaming and Task Manager Points at “Antimalware Service Executable”
You open Task Manager to figure out why your laptop sounds like it’s about to take off, and there it is: Antimalware Service Executable, sitting at 40%, 60%, sometimes pinned near 100% CPU. It’s not malware, and it’s not a virus pretending to be a security tool – it’s the real process behind Windows Defender, doing exactly what it’s supposed to do. The problem is it’s doing too much of it, too often, or scanning the wrong things.
A little background use is normal – Defender typically sits around 1-5% CPU during idle scanning. What you’re seeing crosses into a real problem when it stays elevated for more than about ten minutes at a stretch, especially if it happens repeatedly rather than as a one-off scan after a big update.
Rule Out an Active Scan First
Before changing any settings, check whether this is just a scheduled scan running its course. Open Windows Security, go to Virus & threat protection, and check if a scan is currently in progress. If one is, and this is the first time you’ve noticed the spike, it may resolve on its own once the scan finishes – full system scans can genuinely take a while and are CPU-intensive by design.
If there’s no scan running and the CPU usage is still high, or if this happens constantly rather than just during scans, the cause is usually one of a few specific things below.
Antimalware Service Executable High CPU: Fix It With Exclusions
The most common real cause is Defender repeatedly scanning the same large set of files – a folder full of files that change constantly, like a development project, a game’s cache folder, or a sync client’s working directory. Each change triggers a rescan, and if that folder is large or the files change often, Defender can end up in a near-constant scanning loop.
To add an exclusion: open Windows Security > Virus & threat protection > Manage settings (under Virus & threat protection settings), scroll to Exclusions, and click Add or remove exclusions. Add the specific folder causing the issue – not your entire drive, and not a system folder, just the one directory generating the constant activity.
Be specific with exclusions. Excluding your entire user folder or C: drive removes Defender’s protection from nearly everything, not just the source of the slowdown. Identify the actual folder first rather than excluding broadly to make the CPU spike stop faster.
Find the Exact Folder If You Don’t Already Know It
If you’re not sure which folder is causing the loop, Microsoft’s own Process Monitor tool (part of Sysinternals, free to download) can show you directly. Run it as administrator, let it capture for about five minutes while the CPU spike is happening, then filter the process column for MsMpEng.exe and look at what shows up in the Path column repeatedly. A folder appearing hundreds or thousands of times in a short capture window is almost certainly your culprit.
What Not to Do
When Antimalware Service Executable high CPU shows up, don’t try to end the process in Task Manager or disable Windows Defender entirely as a first response. Antimalware Service Executable is a protected system process – ending it either fails outright with an access denied error, or Windows restarts the service within seconds anyway, so you gain nothing but lose your only real-time protection in the meantime. If you’re running a separate third-party antivirus and Defender shouldn’t be active at all, that’s a different and more specific fix than simply killing the process.
If Exclusions Don’t Fix It
A CPU spike that persists even with reasonable exclusions in place, especially right after a Windows update, can sometimes be a corrupted security definitions update rather than a genuine scanning workload. Open Windows Security > Virus & threat protection > Check for updates to force a fresh download of the latest definitions, which occasionally resolves spikes tied to a bad definition file. If that doesn’t help either, running sfc /scannow from an administrator Command Prompt is worth trying, since a corrupted system file can occasionally affect how Defender’s scanning engine behaves.
Antimalware Service Executable high CPU is usually solvable without turning off protection. If your PC has been running warm or noisy for a while and you’re not sure it’s Defender specifically, it’s worth ruling out a broader freezing or performance issue – our File Explorer freezing fix guide covers a related category of Windows 11 performance problems worth checking against.
Tested on: Windows 11 24H2 · Windows 11 25H2 – Updated August 2026
Tags: antimalware service executable high cpu usage windows 11 fix, MsMpEng.exe high CPU disk usage fix, windows defender exclusions high CPU folder scanning loop
