Disable stop or uninstall endpoint protection service

Endpoint Protection / Microsoft Defender Antivirus is the built-in security for Windows and should not be permanently disabled or uninstalled, but the high CPU usage can be reduced and the service can be checked.

Follow these steps in order:

1. Restart the device

• Close all apps and restart Windows.
• This often clears a stuck scan or service state that causes high CPU.

2. Check the Windows Defender Antivirus service
3. Press Win+R, type services.msc, and press Enter.
4. Find Windows Defender Antivirus Service.
5. Make sure Startup type is set to Automatic.
6. In the Action menu, select Start.
   • If Start is greyed out, select Stop, wait for it to stop, then select Start again.
7. Note any error messages that appear; if there are errors, contact Microsoft Support and provide those details.
8. Remove conflicting third‑party security software (if present)
9. Press Win+R, type appwiz.cpl, and press Enter.
10. In Programs and Features, uninstall any third‑party antivirus or security suites.
11. Restart the computer. Caution: While third‑party security software is removed and before Defender is fully working again, the device may be temporarily unprotected.
12. Confirm the high CPU is from Defender
13. Press Ctrl+Shift+Esc to open Task Manager.
14. On the Details tab, check if MsMpEng.exe (Microsoft Defender Antivirus) is the process using high CPU.
15. If the spike happens only during a scheduled scan, wait for the scan to complete and see if CPU returns to normal.
16. If high CPU persists (advanced)

• For admins, Microsoft Defender for Endpoint provides a troubleshooting mode and guidance:
  1. Confirm MsMpEng.exe is the cause in Task Manager.
  2. Capture activity with Process Monitor (ProcMon) during the CPU spike and identify specific files, folders, or processes causing heavy scanning.
  3. In an elevated PowerShell window, add targeted exclusions based on ProcMon findings, for example:
     • Set-MpPreference -ExclusionPath "C:\\Path\\To\\HeavyFolder"
     • Set-MpPreference -ExclusionExtension ".ext"
     • Set-MpPreference -ExclusionProcess "C:\\Path\\To\\App.exe"
  4. Re-check CPU usage after adding exclusions.

Do not fully disable or uninstall Defender/Endpoint Protection unless another trusted enterprise security solution is in place and managed by an administrator, as this leaves the system exposed to malware.

References:

• Troubleshoot Windows Defender or Endpoint Protection client
• Troubleshooting mode scenarios in Microsoft Defender for Endpoint
• Troubleshoot performance issues related to real-time protection
• Endpoint Protection