What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If Antimalware Service Executable is near the top of Task Manager, Microsoft Defender Antivirus may be scanning files; the process is commonly shown as MsMpEng.exe. Scan activity can use CPU and memory, and large disks or archives can make scans take longer. High usage by itself does not prove malware or a broken installation: first check whether a scan is active and whether the load follows a particular scan or workload.
What Antimalware Service Executable does
Microsoft Defender Antivirus is built into Windows 10 and Windows 11. Its real-time protection checks files, and it also performs scheduled and user-initiated scans. Settings names and paths can vary by Windows version.
A full scan checks every file and program, so it can take longer on drives with many files or large archives. Resource use during an active scan is not, by itself, evidence of malware or a broken installation.
1. Check whether a scan or threat response is in progress
- Press Ctrl + Shift + Esc to open Task Manager and check CPU, Memory, and Disk usage for Antimalware Service Executable.
- Open Windows Security > Virus & threat protection. Check Current threats, last scan time, scan duration, and files scanned.
- Note whether the load persists after the scan or relevant file activity has finished. Close unneeded applications and let Defender work while the PC is idle.
2. Update Windows and Defender
If scans fail, threats return, or resource use remains disruptive, install available Windows updates and update Defender security intelligence before trying the scan again.
#1 Best Overall
Update Windows
- Open Start > Settings > Windows Update.
- Select Check for updates, install available updates, and restart if requested.
Update Defender security intelligence
- Open Windows Security > Virus & threat protection.
- Find Virus & threat protection updates or similarly named security-intelligence settings.
- Select the option to check for updates.
3. Run the appropriate scan
| Scan | When to use it | Disruption |
|---|---|---|
| Quick | For a fast check of common locations. | Usually less extensive than a full scan. |
| Full | When you need Defender to check every file and program. | Can take longer and use resources. |
| Custom | To check selected files or folders. | Limited to the locations selected. |
| Microsoft Defender Offline | When persistent malware may be hiding while Windows is running. | Requires a restart and scans in Windows Recovery Environment. |
Choose a scan under Virus & threat protection > Scan options or the equivalent settings in your Windows version. Save open work before an offline scan. If you suspect an infection, update security intelligence and run a full scan; consider the offline scan if the threat persists after restart.
4. Reduce scan disruption safely
Microsoft says Defender tries to scan while the device is not in use. If a scheduled scan repeatedly interrupts your work, you can review its timing in Task Scheduler.
- Open Start, search for Task Scheduler, and launch it.
- Browse to Task Scheduler Library > Microsoft > Windows > Windows Defender.
- Open Windows Defender Scheduled Scan and review its Triggers.
- If you change the schedule, choose a time when the PC is normally idle and save the change.
Do not kill MsMpEng.exe, delete Defender tasks, or use registry hacks to suppress scanning. These are not reliable fixes and can leave the PC less protected.
5. Check available system-drive space
If scans fail or threat removal is incomplete, make sure the drive containing Windows has free space. Open Settings > System > Storage and remove temporary files you no longer need, empty the Recycle Bin, or move personal files. Do not delete random files from Windows or Program Files folders.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match6. Identify what is driving scan activity
If the slowdown is repeatable, Microsoft’s Defender performance analyzer can help identify files, paths, extensions, and processes associated with scan impact. It provides diagnostic evidence; it is not intended to recommend exclusions.
- Open PowerShell as administrator.
- Start a recording with New-MpPerformanceRecording -RecordTo .\Defender-scans.etl.
- Reproduce the slowdown, then press Enter in the PowerShell window to stop and save the recording.
- Analyze it with Get-MpPerformanceReport -Path .\Defender-scans.etl -TopFiles 10 -TopExtensions 10 -TopProcesses 10 -TopScans 10.
The recording requires administrator elevation and a supported Defender platform version. If the report does not explain the issue, Microsoft’s next diagnostic steps include Process Monitor and then Windows Performance Recorder for deeper tracing.
Rank #3
7. Treat exclusions as a security decision
An exclusion reduces what Defender checks and can leave your device and data vulnerable. Investigate the cause first, and use an exclusion only as a last resort when evidence points to a specific, trusted workload or file set.
Windows Security permits exclusions for a file, folder, file type, or process under Virus & threat protection > Manage settings > Exclusions. A process exclusion can exempt files opened by that process from real-time scanning; scheduled and on-demand scans may still scan those files unless a file or folder exclusion also applies. For a process exclusion, use the full path and filename to reduce the risk of matching a different program with the same name.
Prefer the smallest scope that addresses the diagnosed issue. Do not broadly exclude MsMpEng.exe, an entire drive, common file types, or broad folders as a routine performance fix. Remove an exclusion when it is no longer needed and review exclusions periodically.
8. Check which antivirus provider is active
Open Windows Security > Virus & threat protection > Manage providers or the equivalent provider settings to see which product is protecting the device. Microsoft says a non-Microsoft antimalware product can disable Microsoft Defender Antivirus automatically. Multiple antimalware products running at the same time may slow or destabilize the PC, so do not install a second antivirus as a performance fix.
How to choose the next troubleshooting step
| Action | Diagnostic value | Protection impact | Disruption or skill |
|---|---|---|---|
| Check scan status and run an appropriate scan | Shows whether a scan or threat response explains the load. | Maintains Defender protection. | Low; an offline scan requires restart. |
| Adjust scheduled-scan timing | Helps determine whether scheduled scans interrupt work. | Maintains protection. | Low; requires Task Scheduler. |
| Capture a performance recording | Helps identify scan-impacting files, paths, extensions, or processes. | Does not itself reduce scanning coverage. | Requires administrator PowerShell. |
| Add a narrowly scoped exclusion | May address a diagnosed trusted workload. | Reduces scanning coverage for the excluded scope. | Requires a careful security decision. |
When high usage may indicate malware
Resource use alone does not prove an infection. If you see repeated detections or a threat that returns after restart, review Virus & threat protection > Protection history, update security intelligence, and run a full scan. Use Microsoft Defender Offline if persistent malware may be hiding while Windows is running.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.FAQ
Can I stop Antimalware Service Executable in Task Manager?
Ending it does not solve the cause and may leave scanning incomplete; Defender may also restart its protected components. Check scan status, adjust scan timing if appropriate, or investigate a repeatable workload instead.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Why does MsMpEng.exe use a lot of disk during a scan?
Defender is checking files. Large disks and archives can make scans take longer, and resource use may fall when the scan completes. If the problem repeats, use a performance recording to investigate what is driving scan activity.
Will excluding MsMpEng.exe stop Defender from scanning?
No. Exclusion behavior depends on whether you exclude a file, folder, file type, or process. A process exclusion can exempt files opened by that process from real-time scanning, while scheduled and on-demand scans may still check them unless a file or folder exclusion also applies.
How do I know whether Defender is scanning?
Open Windows Security > Virus & threat protection and review the Current threats area, last scan time, scan duration, and files scanned. Task Manager shows resource use but does not identify the exact scan activity by itself.
Does another antivirus turn off Microsoft Defender?
A non-Microsoft antimalware product can disable Microsoft Defender Antivirus automatically. Check Manage providers to see which product is active; running multiple antimalware products at once may slow or destabilize the PC.
The Bottom Line
First check whether a scan or threat response is in progress, then update Windows and Defender and run the appropriate scan. If the slowdown repeats, use Defender’s performance analyzer to investigate the workload. Adjust scan timing where useful, and reserve narrowly scoped exclusions for a diagnosed cause because they reduce scanning coverage.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
