msmpeng.exe causing hdd usage to 100% on configuration manager clients

Question

We have 5400 SCCM computers which includes desktops and laptops in our school district. For last few months we have noticed our staff desktop running really slow. After some troubleshooting we have found most of time when desktop is slow MsMpENG.exe is running and disk utilization is at 100%. Full antimalware scan is scheduled to run at 10pm every Thursday. I have excluded MsMpENG.exe in Antimalware policy but it is not helping either. MsMpEng.exe still runs during the day on random computers and cause 100% disk usage.

Time being fix for specific machine would be to kill Windows Defender Scheduled Scan task in Task scheduler. Sometime Windows Defender Scheduled Scan is not even running but MsMpEng.exe still causing disk utilization of 100%. I have changed scheduled scan for different times but it didn't help. I have searched online and add exclusions as per suggested in custom antimalware policies.

Need help or ideas to fix this issue or check a log where I can see if a file or process on conflict during scan.

I couldn't find problem specific tags so have to add Windows 10-network.

RJ

Answer 1

Hello RajivJindal

It is quite possible that other of the tasks related to Defender is involved. My recommendation would be ti configure the scheduled task out of working hours for Cache Maintenance, CleanUp and Verification Task.

Another setting to try is to configure in the "Conditions" tab of the Task, to "Start only if the computer is idle for X minutes" so you can ensure that the user is not working at that moment.

And about cleaning up some potential bad updates (corrupt signature in the repository, for instance) you can try the next in a test computer:

From an elevated command prompt:

Type in the following command and press “Enter”
"%PROGRAMFILES%\Windows Defender\MPCMDRUN.exe" -RemoveDefinitions -All
Note: Keep the commas in the command

After that, type in the following command and press “Enter”
"%PROGRAMFILES%\Windows Defender\MPCMDRUN.exe" -SignatureUpdate

---

--If the reply is helpful, please Upvote and Accept as answer--