Windows Defender High CPU Usage

Fix 1: Wait for the active scan to finish

Open Task Manager (Ctrl+Shift+Esc) and sort by CPU. If MsMpEng.exe is at the top, open Windows Security → Virus & threat protection and check whether a scan is in progress. Full scans on HDDs take 20–60 minutes; SSDs typically finish in under 10 minutes. The safest action is to let it complete — Defender caches already-checked files, so subsequent scans are significantly faster.

Fix 2: Schedule scans for off-hours

By default Defender runs a Quick Scan daily at 2:00 AM. If your PC sleeps at night the missed scan runs the next time the machine is idle — often while you're working. To change the time: open Task Scheduler (search in Start) → Task Scheduler Library → Microsoft → Windows → Windows Defender → double-click Windows Defender Scheduled Scan → Triggers tab → edit the trigger to a time that suits you, such as 3 AM on weekends only.

Fix 3: Add exclusions for trusted high-write folders

If MsMpEng.exe spikes whenever you open a specific app — game directories, Node.js node_modules folders, or virtual machine disk images — Defender is re-scanning those files on every access. Open Windows Security → Virus & threat protection → Manage settings → Add or remove exclusions → Add an exclusion → Folder. Only exclude folders you fully control. Never exclude Downloads or system folders.

Fix 4: Turn off automatic sample submission

Defender periodically uploads suspicious files to Microsoft for analysis, causing brief CPU and network bursts. To disable it: Windows Security → Virus & threat protection → Manage settings → toggle off Automatic sample submission. This does not weaken real-time or cloud-delivered protection — it only stops file uploads when Defender is uncertain about a file.

Fix 5: Rebuild the Defender scan cache

A corrupt scan history can cause Defender to re-examine already-cleared files on every pass, creating a sustained CPU loop. Open Command Prompt as administrator and run these two commands in order:

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -removedefinitions -dynamicsignatures
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate

Restart your PC after both commands complete.

Fix 6: Remove conflicting antivirus software

Running two real-time antivirus products simultaneously — Defender plus Avast, McAfee, Norton, or similar — causes constant cross-scanning and can push MsMpEng.exe to 30–50% CPU permanently. Open Settings → Apps and uninstall any third-party security suite you no longer use. Windows 11 automatically disables Defender's engine when a compatible third-party AV is installed — but partial uninstalls leave both products active and fighting each other.

Fix 7: Find the app writing files constantly

Some background apps — torrent clients, download managers, software update services — write thousands of new files per hour. Every new file triggers a Defender real-time scan. Open Resource Monitor (search in Start) → Disk tab → sort by Total (B/sec). If one process is writing megabytes per second in the background, that is the root cause. Disabling or rate-limiting that app reduces MsMpEng.exe CPU use proportionally.