antimalware service executable

Question

scan running constantly. uses 40 to 60% memory and 10 cpu and 40% disc. on start up and then is continual. need to schedule scan

Answer 1

The best first option is to perform a full scan with the Microsoft Safety Scanner, ignore any files listed during the scan, at the end of the scan is it indicated any malware was found and removed from your PC.

https://learn.microsoft.com/en-us/defender-endpoint/safety-scanner-download

Then, restart (not shut down) your PC and check if the Anti-malware executable resource usage has returned to normal.

Answer 2

To reduce constant resource usage from Antimalware Service Executable (Microsoft Defender Antivirus) and run scans on a schedule instead, configure scheduled scans and adjust scan CPU usage.

1. Configure a scheduled scan in Windows Security (home PC)
2. In the taskbar search box, type Task Scheduler and open it.
3. In the left pane, expand:
   • Task Scheduler Library → Microsoft → Windows
   • Scroll down and select the Windows Defender folder.
4. In the middle pane, double‑click Windows Defender Scheduled Scan.
5. Go to the Triggers tab and select New….
6. Set:
   • Begin the task: On a schedule
   • Choose Daily or Weekly
   • Set a time when the PC is on but not in active use
7. Click OK, then OK again to save.

This makes Defender run its main scheduled scan at the time chosen instead of scanning heavily at random times.

2. (Enterprise/managed PCs) Limit CPU usage for scans via Group Policy If the device is domain‑joined and managed by Group Policy, an admin can further reduce impact:

• Open Group Policy Management Editor and go to the Microsoft Defender Antivirus policies.
• Under Scan:
  • Set Specify the maximum percentage of CPU utilization during a scan to a lower value (for example, 20–30 instead of the default 50). This reduces CPU load but makes scans take longer.
  • Ensure Start the scheduled scan only when computer is on but not in use is Enabled so scans run when the machine is idle.
• Under Root:
  • Randomize scheduled task times should be Enabled.
  • Optionally configure Configure scheduled task times randomization window to spread scan start times.

3. General performance tips

• Run scans when the PC is idle: close other apps before a scan so Defender doesn’t compete for CPU, memory, and disk.
• Expect longer scans on large disks or when scanning large archives (.zip, .rar, etc.).
• If scans seem stuck or extremely slow, ensure there is enough free disk space on the system drive, then update Defender and run the scan again.

Real‑time protection should remain enabled for safety; rely on scheduled scans and the CPU‑limit settings to reduce constant high usage rather than turning protection off.

---

References:

• Help protect my device with Windows Security
• Troubleshoot performance issues related to real-time protection
• Schedule antivirus scans using Group Policy
• How to create and deploy antimalware policies for Endpoint Protection in Configuration Manager
• Troubleshoot problems with detecting and removing malware