Defender Antivirus high CPU (MsMpEng.exe): find the cause with the performance analyzer

When Antimalware Service Executable (MsMpEng.exe) sits near the top of Task Manager, the quick fix people reach for is a broad exclusion, which removes protection and often misses the real cause. In this post I'll show how to tell scheduled scans from real-time scanning, record what Defender is actually scanning with the performance analyzer, and fix it with the narrowest change that works.

Symptoms#

• Task Manager shows Antimalware Service Executable using a lot of CPU during builds, installs, sign-in or at the same time every day.
• Specific applications such as compilers, package managers, database or log writers and backup agents slow down while Defender works.
• The busy periods line up with these events in the Windows Defender Operational log:

Event ID 1000 (Windows Defender): An antimalware scan started.
Event ID 1001 (Windows Defender): An antimalware scan finished.

• Starting a recording fails with Cannot start performance recording because Windows Performance Recorder is already recording.

Why it happens#

Defender's CPU comes from two different workloads, and they need different fixes:

• Scans: scheduled quick or full scans, catch-up scans and on-demand scans. A full scan reads every file on the device.
• Real-time (on-access) scanning: every file a process opens or writes is inspected. Workloads that touch thousands of files a minute, such as build output, package caches, log folders and VDI profiles, generate a steady stream of scans.

Two things make both worse: a second real-time antivirus running next to an active Defender (see active and passive mode), and exclusions that never match because they're written wrongly.

How to fix it#

1. Find out when the CPU goes up#

Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-Windows Defender/Operational'; Id = 1000, 1001, 1002
} -MaxEvents 20 | Select-Object TimeCreated, Id, Message

Get-MpPreference | Select-Object ScanParameters, ScanScheduleDay, ScanAvgCPULoadFactor

If the spikes sit between a 1000 and a 1001 (or 1002, a scan stopped before it finished), it's a scan problem; go to step 4. If CPU is high with no scan running, it's real-time scanning, so record it.

2. Record with the performance analyzer#

The analyzer needs platform version 4.18.2108.7 or later and runs on Windows 10, Windows 11 and Windows Server 2016 or later (Windows Server 2012 R2 on the unified solution also needs the Windows Performance Toolkit from the Windows ADK). In an elevated PowerShell session, start a recording to a folder that exists, reproduce the slow task, then press Enter:

New-MpPerformanceRecording -RecordTo C:\Perf\defender-scans.etl

If you get the "already recording" error, cancel the stale trace and start again:

wpr -cancel -instancename MSFT_MpPerformanceRecording

3. Read the report#

$etl = 'C:\Perf\defender-scans.etl'
Get-MpPerformanceReport -Path $etl -TopFiles 10 -TopExtensions 10 -TopProcesses 10 -TopScans 10
Get-MpPerformanceReport -Path $etl -TopFiles 3 -TopScansPerFile 10
(Get-MpPerformanceReport -Path $etl -TopScans 1000).TopScans |
    Export-Csv -Path C:\Perf\scans.csv -Encoding UTF8 -NoTypeInformation

Look for concentration: one process behind most scans, one folder that's rewritten constantly, or one extension with a high total duration. The report shows scan counts, durations, paths, processes and the reason for each scan, and the SkipReason column shows Not Skipped, Optimization (usually a performance optimization) or User skipped (usually an exclusion you set).

4. Fix scan-driven CPU#

• Move scheduled scans out of working hours and prefer quick scans for the regular schedule.
• ScanAvgCPULoadFactor limits the average CPU a scan should use (default 50 percent), and Set-MpPreference -EnableLowCpuPriority $true runs scheduled scans at low CPU priority.
• Set these in your Intune or Group Policy antivirus policy rather than locally, so they don't drift or conflict.

5. Fix real-time CPU with the narrowest exclusion#

Every exclusion is a protection gap, so pick the smallest one that removes the hot spot:

1. Contextual exclusion (best): exclude a folder only for on-access scans, or only when a named process opens it. It needs Defender as the primary antivirus, platform 4.18.2205.7 and engine 1.1.19300.2 or later, and can't be set in the Windows Security app. Keywords and values are case-sensitive, and a backslash must precede the colon.

Add-MpPreference -ExclusionPath 'C:\BuildOutput\: {PathType:folder,ScanTrigger:OnAccess,Process:"C:\Tools\builder.exe"}'

2. Process exclusion by full path: skips files that process opens. An image name alone (builder.exe) matches that name anywhere, even on removable media, and process exclusions also stop network protection and ASR rules from inspecting the process.
3. Folder exclusion: covers the folder and its subfolders, except reparse point subfolders.
4. Extension exclusion (last resort): applies on every drive. Prefer a path with a wildcard, such as C:\Data\*.log.

Avoid mapped drive letters (use the real network path) and file names without a path. Environment variables resolve in the SYSTEM context, so %TEMP% means C:\Windows\TEMP. Excluded files can still raise EDR alerts and behavioral detections.

6. Developers on Windows 11: use Dev Drive#

On a trusted Dev Drive, performance mode scans files asynchronously ("open now, scan later"), which Microsoft says gives significantly better protection than folder exclusions. It's on by default for new Dev Drives and needs Defender as the primary antivirus with real-time protection on (platform 4.18.2303.8 and security intelligence 1.385.1455.0 or later). Turn it on with Set-MpPreference -PerformanceModeStatus Enabled, the Defender CSP setting ./Device/Vendor/MSFT/Defender/Configuration/PerformanceModeStatus (0 enables it) or the Group Policy setting Configure performance mode status. Microsoft is clear that performance mode isn't a fix for general MsMpEng.exe high CPU; use the analyzer for that.

Verify the fix#

• Record the same workload again and compare total duration and top processes; your excluded paths should now show User skipped.
• Watch Task Manager during the workload: CPU should drop back after short bursts.
• Confirm the exclusion with Get-MpPreference | Select-Object -ExpandProperty ExclusionPath (unless exclusions are hidden from local admins).

Prevent it next time#

• Measure before you exclude, and record why each exclusion exists. Review the list regularly.
• Keep the Defender platform and engine current; see platform and engine updates.
• Manage exclusions in one policy; local and policy lists merge by default, which hides forgotten entries (Defender settings not applying).

References#

• Performance analyzer for Microsoft Defender Antivirus
• Exclusions in Microsoft Defender Antivirus
• Protect Dev Drive using performance mode