High CPU Usage by Antimalware Service Executable

Question

Title. I had this issue and then I decided to reset my PC. After resetting it, i didn't open anything else and the exact same thing occured. I tried other solutions online but most of them reccomended adding exclusions, but Windows Security doesn't even load, it gets stuck on a solid white screen.

Im running Windows 11.

Answer 1

You can try adding Antimalware Service Executable (MsMpEng.exe) to exclusion list, see if it helps:

1. Open Windows Security.
2. Click on Virus & threat protection > Virus & threat protection settings.
3. Locate 'Exclusions' and click Add or remove exclusions.
4. Hit Add an exclusion and select Process in drop down.
5. In Add an exclusion, type MsMpEng.exe and click Add.

Alternatively, please refer the first reply suggestion in this thread:

https://learn.microsoft.com/en-us/answers/questions/3230441/high-cpu-usage-because-of-antimalware-service-exec

If issue still persists, you can refer other suggestions in this fix:

https://www.kapilarya.com/fix-antimalware-service-executable-msmpeng-exe-high-cpu-usage

Let us know if that helps you!

Note: Included link(s) in this reply refers to a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.

Answer 2

Hi Zack A,

Since the issue returned immediately after a PC reset, the next useful step is to determine whether Microsoft Defender is actively scanning something repeatedly, rather than adding broad exclusions right away. The fact that Windows Security is opening to a blank white screen may also indicate the Security app itself is not loading correctly.

Please consider following these steps:

1. Open Task Manager > Details and confirm whether MsMpEng.exe is the process consuming CPU.
2. Check if CPU usage stays high even when the system is idle for several minutes after startup.
3. If it does, capture a short trace with Process Monitor (ProcMon) while the spike is occurring and look for any specific file, folder, or application being scanned continuously.

If you can share the approximate CPU percentage, whether it is constant or intermittent, and whether MsMpEng.exe is the process responsible, that would help narrow down whether this is a Defender scanning workload or a Windows Security component issue.

I hope this helps point us in the right direction. Let me know if you need further assistance, feel free to ask me by clicking "Add Comment" or "Add Answer" if you cannot add comment so your response will be visible. Thanks for your effort.

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Try this in order:

1. Fix the Windows Security app first.
   • Download SecurityHealthSetup from the Microsoft Update Catalog entry referenced below.
   • Right-click the downloaded securityhealthsetup_*.exe and run it as administrator.
   • A couple of command windows should flash.
   • Check Windows Security again. If it is still blank, restart Windows and wait a few minutes before opening it.
2. Confirm whether MsMpEng.exe is the source of the CPU spike.
   • Open Task Manager.
   • Go to the Details tab and confirm MsMpEng.exe is the process using high CPU.
   • Also check whether a scheduled scan is running at the same time.
3. If the CPU spike continues, collect evidence while the issue is happening.
   • First use the Microsoft Defender Antivirus Performance Analyzer.
   • If that does not identify the cause, run Process Monitor (ProcMon) during the spike for about 5 minutes and review the log.
   • For deeper tracing, Windows Performance Recorder UI (WPRUI) can be used, but keep that capture to 3 to 5 minutes while the issue is actively reproducing.
4. Check for common causes of high Defender CPU usage.
   • Misspelled exclusions can cause exclusions not to work. Validate path exclusions with: MpCmdRun.exe -CheckExclusion -Path <PathAndFile or Path>
   • Unsigned binaries can increase scanning overhead when they start.
   • Obfuscated scripts can increase CPU during scanning.
   • Complex file formats used like databases can also increase CPU.
   • If file hash computation is enabled, it can add performance overhead, especially when copying large files.
5. If ProcMon or the analyzer shows a specific trusted app, process, or folder is triggering scans, add a targeted exclusion.
   • Use an elevated PowerShell window.
   • Examples:
     • Set-MpPreference -ExclusionPath "C:\DB\DataFiles"
     • Set-MpPreference -ExclusionExtension ".dbx"
     • Set-MpPreference -ExclusionProcess "C:\DB\Bin\Convertdb.exe"
   • After adding the exclusion, check whether CPU usage drops.
   • Exclusions reduce scanning coverage, so only exclude trusted locations or processes.
6. If the issue is mainly during gaming, adding the game install folder to exclusions is a common workaround once Windows Security is working again.

Because the problem returned immediately after a reset, focus first on repairing the Windows Security UI, then capture the Defender activity during the spike instead of applying broad exclusions blindly.

---

• Windows 11: Windows Security shows a blank white page when opened. Additionally, when trying to access Windows Security settings, it displays a message saying “Contact your IT administrator.” - Microsoft Q&A
• Troubleshooting mode scenarios in Microsoft Defender for Endpoint
• Troubleshoot performance issues related to real-time protection
• Troubleshoot Microsoft Defender Antivirus performance issues with Process Monitor
• Antimalware Service Executable CPU Problems - Microsoft Q&A