Why Does Windows Defender Use High CPU All the Time? Causes, Fixes, and How to Reduce It Safely

If you’ve opened Task Manager and noticed Windows Defender using high CPU all the time, you’re not alone. Many Windows users see the Antimalware Service Executable (MsMpEng.exe) consuming anywhere from 20% to 100% of CPU resources, making their PC sluggish, noisy, or unresponsive.

Sometimes this behavior is completely normal. Windows Defender performs scheduled scans, checks newly downloaded files, and monitors your system for threats in real time. During those tasks, temporary CPU spikes are expected.

The problem starts when high CPU usage continues for hours, happens every day without an obvious reason, or affects your computer even when you’re doing simple tasks. In those cases, there’s usually an underlying cause that needs attention.

This guide explains why Windows Defender keeps using high CPU, how to identify the exact reason, and the safest ways to reduce its resource usage without weakening your computer’s security.

Understanding why Windows Defender uses CPU

Windows Defender, now officially called Microsoft Defender Antivirus, constantly examines files, processes, applications, and network activity to detect malware before it can harm your computer.

Unlike a manual antivirus scan that only runs when you start it, Defender performs several background tasks automatically, including:

• Real-time file monitoring
• Scheduled full and quick scans
• Checking downloaded files
• Scanning USB drives
• Verifying newly installed applications
• Monitoring running processes
• Updating malware definitions

Every one of these tasks requires processor time. The amount depends on what Defender is scanning and how much data it needs to inspect.

Seeing occasional CPU spikes is normal. Seeing sustained high usage throughout the day usually means something else is causing Defender to work much harder than expected.

Common reasons Windows Defender uses high CPU all the time

Several different issues can produce the same symptom.

A scheduled scan is running

This is the most common explanation.

Windows automatically schedules antivirus scans during periods when your computer is expected to be idle. If the PC was asleep or powered off during the scheduled time, Defender may begin scanning shortly after you start using it.

During a full scan, CPU usage can become noticeably higher, especially on:

• Older processors
• Hard disk drives (HDDs)
• Systems with many files
• PCs containing multiple user accounts

A full scan can take anywhere from several minutes to several hours depending on storage size.

Real-time protection is scanning many files

Every time a file changes, Defender may inspect it.

Activities that generate thousands of file operations can trigger heavy CPU usage, including:

• Extracting ZIP or RAR archives
• Installing large programs
• Downloading game updates
• Copying large folders
• Compiling software
• Editing videos
• Working with virtual machines

In these situations, Defender is reacting to legitimate activity rather than malfunctioning.

Large software updates

Windows Update installs thousands of files during feature updates and cumulative updates.

Since Defender checks many of these files as they’re written to disk, CPU usage often increases during or shortly after Windows updates.

This usually stops automatically after the update finishes.

Malware definitions were recently updated

Microsoft regularly updates Defender’s malware signatures.

After receiving new definitions, Defender may recheck files using the latest detection rules.

This often explains temporary spikes that appear shortly after Windows Update runs.

Another antivirus is conflicting with Defender

Running multiple antivirus programs simultaneously is rarely a good idea.

Two security programs may repeatedly scan the same files, causing:

• Constant CPU usage
• Slow performance
• Longer startup times
• Excessive disk activity

Although Windows usually disables Defender’s real-time protection when another antivirus is installed, this doesn’t always happen correctly, especially after uninstalling older antivirus software.

Corrupted Defender files

Occasionally, Defender itself develops problems.

Examples include:

• Damaged antivirus definitions
• Corrupted scan history
• Incomplete Windows updates
• Broken system files

These issues can cause Defender to repeatedly restart scans or become stuck processing the same files.

An unusually large number of files

Some computers simply contain millions of files.

Developers, photographers, video editors, engineers, and gamers often have directories containing hundreds of thousands of small files.

Scanning these folders naturally requires more CPU time than scanning an average home computer.

A slow hard drive

CPU usage isn’t always the real bottleneck.

On older systems with mechanical hard drives, Defender may appear to use a large percentage of CPU while actually waiting for slow disk operations.

Replacing an HDD with an SSD often reduces the overall time Defender needs to finish scans.

How to check whether Defender is actually scanning

Before changing any settings, determine whether Defender is actively scanning your computer.

Open Task Manager by pressing Ctrl + Shift + Esc.

Look for:

• Antimalware Service Executable
• MsMpEng.exe

If CPU usage gradually decreases over several minutes, Defender is probably completing a legitimate scan.

You can also check Windows Security:

1. Open Windows Security.
2. Select Virus & threat protection.
3. View your protection history.
4. Check whether a scan is currently running or recently completed.

If Defender stays above 30% to 50% CPU for hours without finishing, further troubleshooting is worthwhile.

How to reduce Windows Defender’s CPU usage

Let the scan finish first

Many users stop Defender the moment CPU usage increases.

In many cases, that’s unnecessary.

If the scan has only recently started, allowing it to complete often resolves the issue automatically.

Interrupting scans repeatedly may cause Defender to restart them later.

Restart your computer

A simple restart can clear temporary issues, including:

• Stuck Defender services
• Hung scans
• Pending updates
• Temporary cache problems

If high CPU returns immediately after every restart, another cause is likely responsible.

Install Windows updates

Microsoft regularly fixes Defender bugs through Windows Update.

To check for updates:

1. Open Settings.
2. Select Windows Update.
3. Click Check for updates.
4. Install everything available.
5. Restart your computer.

Keeping Windows current also ensures Defender uses the latest antivirus engine.

Update Microsoft Defender manually

Sometimes Windows itself is current, but Defender’s antivirus engine isn’t.

Open Windows Security and check that security intelligence updates have installed successfully.

Outdated definitions occasionally lead to repeated scanning behavior.

Schedule scans for idle hours

If scans always begin while you’re working, changing the schedule can improve performance.

Using Task Scheduler, you can configure Microsoft Defender scans to run when your PC is idle or during times you aren’t actively using it.

This doesn’t reduce CPU usage itself, but it prevents the workload from interrupting your normal activities.

Exclude trusted folders carefully

If you work with very large collections of trusted files, exclusions may help.

Examples include:

• Virtual machine folders
• Software development build directories
• Large media libraries that never contain downloads
• Temporary rendering folders

Only exclude folders you completely trust.

Avoid excluding:

• Downloads
• Desktop
• Documents
• Entire drives
• User profile folders

Doing so significantly reduces your protection against malware.

Remove leftover antivirus software

If you’ve switched antivirus products recently, remnants of the previous software may still be installed.

Check:

• Installed applications
• Background services
• Startup programs

Many antivirus vendors also provide dedicated cleanup utilities that remove leftover drivers and services after uninstallation.

Removing these remnants often resolves continuous Defender scanning.

Repair corrupted Windows files

If Defender continues behaving abnormally, repair Windows system files.

Open Command Prompt as Administrator and run:

sfc /scannow

After that completes, run:

DISM /Online /Cleanup-Image /RestoreHealth

These tools repair corrupted Windows components that may affect Defender.

Perform a malware scan

Ironically, malware itself can cause Defender to consume excessive CPU.

Some malicious programs constantly create new files, modify existing ones, or attempt to disable antivirus protection, causing Defender to work continuously.

If you suspect infection:

• Run a full Defender scan.
• Use Microsoft Defender Offline Scan if necessary.
• Consider a reputable second-opinion malware scanner if the issue persists.

Should you disable Windows Defender?

For most users, the answer is no.

Disabling Defender may reduce CPU usage temporarily, but it also removes your primary antivirus protection.

Unless you’re replacing Defender with another reputable antivirus solution, disabling it exposes your computer to unnecessary risk.

If Defender is using high CPU because it’s actively scanning suspicious activity, turning it off doesn’t solve the underlying problem.

Instead, identify why it’s scanning so aggressively.

When high CPU usage is actually normal

Not every CPU spike indicates a problem.

High usage is expected when:

• A full scan has just started
• Windows has finished installing updates
• You’ve downloaded many files
• You’re installing large applications
• You’re copying thousands of files
• Malware definitions were recently updated
• You’ve connected an external drive for the first time

In these situations, CPU usage should gradually decline after the work finishes.

Signs something is wrong

You should investigate further if:

• Defender stays above 50% CPU for several hours.
• CPU usage never returns to normal.
• The same scan restarts repeatedly.
• Your computer freezes every day during Defender scans.
• Windows Security reports errors.
• Defender updates consistently fail.
• High CPU continues even while the computer is idle.

Persistent behavior usually indicates corrupted files, software conflicts, malware, or another issue that requires troubleshooting.

Common mistakes that make the problem worse

Several well-intentioned fixes can create new problems.

One common mistake is disabling real-time protection permanently. While it reduces Defender’s workload, it also leaves your computer vulnerable between manual scans.

Another is excluding entire drives from antivirus scanning. This may improve performance, but it also creates large blind spots where malware can hide.

Some users also install multiple antivirus programs in hopes of improving protection. In practice, this often increases CPU usage because each program scans the same files independently.

Finally, avoid ending the MsMpEng.exe process repeatedly through Task Manager. Windows usually restarts the service automatically, and interrupting scans can make Defender repeat work later.

Frequently asked questions

Why is MsMpEng.exe using 100% CPU?

This usually happens during a full antivirus scan, after major Windows updates, or while scanning large numbers of files. If usage remains at 100% for an extended period without decreasing, investigate for software conflicts, corrupted system files, or malware.

Is high CPU usage from Windows Defender a virus?

No. MsMpEng.exe is a legitimate Microsoft process. However, malware can disguise itself using similar names. Verify that the process is running from the Windows Defender installation directory and not another location.

Does Windows Defender slow down gaming?

It can if a scheduled scan starts while you’re playing. Windows generally tries to avoid running intensive maintenance tasks during active use, but large updates or manually started scans can still affect game performance.

Can I limit Defender’s CPU usage?

Windows doesn’t provide a simple setting to cap Defender’s CPU usage. The best approach is to schedule scans during idle periods, keep Windows updated, remove antivirus conflicts, and use exclusions only for trusted, high-activity folders when appropriate.

Final thoughts

If you’re wondering why Windows Defender uses high CPU all the time, remember that occasional spikes are part of normal antivirus operation. Defender continuously monitors your system, and resource usage naturally increases during scans, updates, and heavy file activity.

When CPU usage remains unusually high for long periods, the cause is often a scheduled scan that never finishes, conflicting security software, corrupted Windows files, or malware creating constant activity. Working through the fixes methodically, starting with updates, allowing scans to complete, checking for conflicts, and repairing Windows if necessary, usually resolves the issue without compromising your system’s security.

The goal isn’t to stop Windows Defender from scanning. It’s to ensure it performs its job efficiently while allowing your PC to remain responsive during everyday use.

Related Articles

• Fix Windows Activation Error 0x8007007B Step by Step
• How to Remove Virus From Windows Without Antivirus Software
• Laptop Keyboard Typing Wrong Characters After Update: Causes, Fixes, and How to Prevent It
• How to Fix External Hard Drive Not Showing Up in Windows 11