Windows Defender (msmpeng.exe) huge memory usage + commit size making PC unsuable until restart

I don't have ANY other security software installed - corporate environment with SCCM Deployment.

This describes our environment as well.  Only a subset of our computers are having this problem with Windows Defender.  The only difference between these computers & our other computers is that the problem computers have Applocker configured while the others do not.  I have dealt with the issue by almost completely disabling realtime protection because I cannot disable Applocker on these devices.  We did not have this issue until 2 or 3 weeks ago.  Nothing has changed in that time other than updates to Windows 10 (1703) & Office.

Notwithstanding my previous response, there's always an outside chance it's not a leak, and that the program is just poorly designed (allocating an unreasonable amount of memory over time). If so then it's holding onto this memory for a ridiculous amount of time, so it's highly likely an actual leak IMHO (or something's broken somewhere). If not then for all intents and purposes it behaves like a leak so the end result is the same. Allocating past 1GB is very common (I've even seen multiple GBs on rare occasion), and in my own case, the leak literally happens daily (after turning it off and on). You either put up with it (resetting it daily in my case), abandon virus protection altogether (not good), or turn to a 3rd-party app, which often have issues as well in my experience (not to mention the security/privacy issues of trusting a 3rd-party company - I have lingering doubts about MSFT as well but you have to trust someone and they're preferable IMHO).

How the hell do we log a ticket with Microsoft about this? I've re-imaged some users' machines and that appears to alleviate it, but I'm concerned it will come back and I can't reimage 300+ machines just because of this.

I even went to the extreme steps of running process monitor through a command prompt through psexec on a machine that had MsMpEng.exe eating 4GB of RAM, and it revealed nothing weird about what MsMpEng was doing, either.

If anyone at Microsoft sees this, I'm happy to provide process monitor dumps and anything else.

Cheers Shendrix, I'll give that a shot and see how things go. 

I appreciate it, thanks.

Hi,

Thank you for the update. Let's confirm if it's an isolated case only or occurring on the whole system by creating a new administrator account. Ensure that it has administrator privileges. Switch profile logins and verify if the same behavior occurs.

We'll keep an eye out for your response.