Antimalware Service Executable (MsMpEng.exe) High Disk Usage Fixed

The antimalware service executable, also known as MsMpEng.exe, is an integral process to the Windows Defender Service on Windows-based computers. If you open up your Windows Task Manager, you’ll find it listed in the details section, as it is a service constantly running in the background. Its primary role is to scan your computer in real-time for threats, such as malware and viruses. However, in doing so, it is infamous for consuming a lot of system resources, which is why many people search for antimalware service executable high disk usage solutions. 

This service can really bog down your computer. Let’s discuss why it may be responsible for high disk usage and how to go about fixing the issue. 

In case you are having issues with Antimalware Service Executable using high amounts of CPU resources, read this article instead.

Why does the antimalware service executable (MsMpEng.exe) cause high disk usage?

When the antimalware service executable is running in the background, it constantly scans your computer’s files, folders, applications, and programs in real-time. As a result, you’ll see this process spike in disk usage when you are installing software, downloading files, or checking your email attachments. 

In addition to this, it will run a full scan once per day, either when the computer wakes up from a sleep state or when it is scheduled to run. When your system does a complete or full scan, you may get frequent freezing or lagging or a delayed response due to the high disk usage. There are other reasons why there may be high disk usage with antimalware service executable, though:

• You are running an older computer with lower-end hardware.
• You are running software or hardware components that conflict.
• You are infected with malware or a virus of some sort.
• Your Windows system files are corrupt or misconfigured.
• Your Windows Defender is outdated.

Now that we know what causes the antimalware service executable (MsMpEng.exe) high disk usage, let’s take a look at how you can fix the issue. 

How to fix the antimalware service executable (MsMpEng.exe) high disk usage issue

1. Check for malware infections

It is highly recommended that you scan your entire system for malware to ensure that there aren’t any malicious scripts causing your Windows Defender memory usage to skyrocket. To run a scan on your computer using Windows Defender, do the following:

1. In your computer’s search bar, type in “Windows Security”.

2. Head to Virus & threat protection and choose Scan options.

3. Instead of doing a quick scan, choose the Full scan option.
4. Hit the Scan now button to start the process. 

Keep in mind that a full scan can take several hours, so you will want to do this when you have the time to leave your computer up and running. 

2. Change your Windows Defender’s scheduling

The most common time when you’ll see the antimalware service executable (MsMpEng.exe) consume high disk usage is when Windows Defender runs a full or complete scan on your computer. So, what you can do is configure this to run a scan when you’re less likely to notice the drain on your computer’s systems.

1. Either tap the Windows key + R, or in your computer’s search, type in “Run”.
2. This brings up the Run dialogue box. 
3. In the run dialogue box, type in “taskschd.msc” and hit Enter.

4. This opens up the task scheduler.
5. In the left-hand pane, choose Windows folder, and then Windows Defender.
6. In the middle pane, choose Windows Defender Scheduled Scan.
7. In the general tab, uncheck “Run with the highest privileges”.

4. Under the conditions tab, uncheck all items.
5. Hit Okay.

Now you can reschedule the full scan for when you are less likely to notice the drain on your system by clicking on Create Task, Triggers Folder, New.

Now simply schedule your full scan whenever you are available: either at a time of day or when a certain process happens, like logging off your computer.

3. Add MsMpEng.exe to the Windows Defender exclusion list

During the full scans, the antimalware service executable high disk usage may be due to the fact that it sometimes scans itself as part of these routine checks. When this happens, you can get a lot of system lag. You can stop this from happening by adding it to the Windows Defender exclusion list.

1. Open the Run dialogue box as shown above.
2. Type into the box “windowsdefender:” and hit Enter.
3. Windows Security center will open up.
4. Choose the Virus & threat protection page.

5. Choose Manage settings from under virus and threat protection settings.
6. Scroll until you see Exclusions and click.

7. Hit the + add an exclusion button on this page.

8. Choose Process from the menu, and type in “antimalware service executable”.

9. Then hit the Add button and exit out. 

4. Change the priority of MsMpEng.exe in the Task Manager

Another way to get around the high disk usage with antimalware service executable is to manually set a limit on how much CPU can be used by MsMpEng.exe. You can do this in the Task Manager.

1. On your keyboard, hit CTRL + Shift + ESC to open the task manager.
2. Hit the More details button on the pop-up screen.
3. Go to the Details tab at the top.
4. Find the msmpeng.exe file in the list.
5. Right-click on it and choose the Set affinity option.

6. Now limit the CPU threshold and close the Task Manager.
7. If set affinity isn’t available to you, you can set the priority to low.

5. Run the System File Checker (SFC)

If any of the files for Windows Defender have become corrupt or damaged, you’ll want to fix these right away. You can do this by running the System File Checker:

1. In your computer’s search menu, type in “Command Prompt”.

2. Right-click it and run it as an administrator. 
3. Type in “SFC /scannow” and hit Enter.
4. Let it run, and if it finds any corrupt files, it will automatically fix them. 

Note: If you run into an SFC /Scannow error when starting the scan, don’t worry. We have written dedicated articles on what to do if SFC scannow is not working, including:

• Windows Resource Protection Could Not Perform The Requested Operation
• Windows resource protection could not start the repair service

6. Remove bad Windows updates

Unfortunately, as Windows updates, sometimes Windows Defender acquires some bad definition updates. When this happens, it causes Windows Defender to think that some of the Windows system files are viruses when they aren’t. This issue can cause the antimalware service executable to ramp up in high disk usage, as it’s falsely identifying these as malware. 

To remove bad definition updates, do the following:

1. In your computer’s search menu, type in “Command Prompt”.
2. Right-click it and run it as an administrator. 
3. In CMD, type in the following and hit Enter:
   “%PROGRAMFILES%\Windows Defender\MPCMDRUN.exe” -RemoveDefinitions -All
4. Then repeat with the following command and hit Enter:
   “%PROGRAMFILES%\Windows Defender\MPCMDRUN.exe” – SignatureUpdate
5. See if the issue persists.

7. Disable real-time protection

Another way around the high disk usage issue related to MsMpEng.exe is to turn off the real-time protection that Windows Defender provides. It is not recommended to keep this off for extended periods of time.

1. Using your keyword, hit the Windows key + I to open Settings.
2. Go to the Update & Security section, then Windows Security. 
3. Go to the Virus & threat protection section. 
4. Choose the Manage settings button.
5. Toggle off the Real-time protection. 

6. Restart your PC.

We highly recommend only toggling this off for a few moments and then turning it back on once the high disk usage has come down. Keeping this toggled off means that you can potentially install malware and viruses while using your computer, as Windows Defender won’t be running in the background to catch potentially malicious software.

8. Last resort: Disable Windows Defender

As a last resort, you can disable Windows Defender, but it’s not recommended as it leaves you vulnerable to malware, viruses, and cyberattacks. If you are planning on disabling Windows Defender for any length of time, either don’t go online at all, or use a third-party antivirus software in the meantime.

For those that want to pursue this option, you will need to use the Registry Editor to disable Windows Defender. You can read more about how to disable Antimalware Service Executable (MsMpEng.exe) here.

Conclusion

If you notice that Windows Defender is putting a huge drain on your computer, it’s likely because of the antimalware service executable high disk usage problem that comes with needing a lot of CPU power to run the real-time protection. If you choose to disable Windows Defender or turn off real-time protection, please understand that in doing so, you make yourself vulnerable to attacks. Keep this in mind and consider other solutions first.