Windows performance

Windows Defender real-time protection using high CPU

Windows Defender's real-time scanning checks files as they're opened or downloaded, and it can spike CPU usage, especially during large file operations or scans of certain program folders.

Difficulty
Easy
Time
15–30 minutes
DIY cost
$0
Pro cost
$0

Symptoms

  • Antimalware Service Executable (MsMpEng.exe) shown high in Task Manager
  • CPU spikes when opening, downloading, or compiling many files
  • Usage settles down after a period of high activity
  • Fans ramp up during large file copies or extractions

Likely causes

  • CommonReal-time scanning checking a large batch of files being copied or extractedEvery new or modified file gets scanned as it's written.
  • CommonScanning development or build folders with thousands of small filesThis is a well-known heavy case for programmers and creators.
  • PossibleA scheduled quick or full scan running at the same timeCombined with real-time protection, this compounds CPU use.
  • PossibleAntivirus definitions updating in the backgroundDefinition updates can briefly increase resource use.
  • PossibleScanning network or external drives with slower read speedsThis can extend how long a scan takes and how much CPU it uses along the way.

What to do

  1. Open Task Manager and confirm 'Antimalware Service Executable' is the process using high CPU.
  2. Let it finish scanning a large batch of new files; usage should drop once it catches up.
  3. Check Windows Security > Virus & threat protection to see if a scheduled scan is currently running.
  4. If you regularly work with large sets of trusted files (like a specific project folder), consider adding a scoped exclusion in Windows Security settings for just that folder.
  5. Reschedule full scans for times you're not actively using the PC.
  6. Make sure Windows Defender's definitions are up to date, since older engines can be less efficient.
  7. Avoid disabling real-time protection entirely, since it's your main defense against malware.
  8. If CPU stays maxed with no clear large operation happening, run a full scan to rule out an infection interfering with the scanner itself.

Tools and parts

  • None required

When to call a pro

This is manageable through settings; professional help is rarely necessary unless it points to a deeper malware issue.

Safety

Generally low risk

Generally low risk for a careful person. Stop if anything looks different from what this guide describes.

Related guides

Operator provides AI-generated troubleshooting information. It can be wrong. For safety-critical, electrical, gas, structural, medical, automotive safety, or other high-risk problems, consult a qualified professional.