Msmpeng is the process behind Windows Defender, your computer’s antivirus program, constantly scanning for threats. Normally, it shouldn’t cause major slowdowns. However, there are times when msmpeng.exe might spike CPU usage.
Causes of High CPU Usage by msmpeng.exe
- Scheduled Scans
Regular scans can temporarily increase CPU usage. - Real-time Protection
Constantly monitoring files and programs can consume resources. - Conflicting Software
Other antivirus programs or security software can clash with Windows Defender. - Low Hardware Resources
Older computers with limited CPU power might struggle with scans. - Stuck Scans
In rare cases, scans can get stuck on a specific file, causing high CPU usage.
How to Fix High CPU Usage by msmpeng.exe
- Check Scan Schedule
See if a scheduled scan is running. You can postpone or adjust the scan schedule in Windows Security settings. - Temporarily Disable Real-time Protection
This is not recommended for long-term use, but it can help diagnose if real-time protection is causing the issue. Turn it back on after troubleshooting. - Update Windows Defender
Outdated definitions might lead to excessive scans. Update Windows Defender to ensure it has the latest threat signatures. - Exclude Folders
If Windows Defender scans specific folders repeatedly, you can exclude them from scans to reduce CPU usage. You can also use PowerShell to add exclusions:- Right-click the Start button and select “Windows PowerShell (Admin)”.
- Use the following command to add an exclusion:
Add-MpPreference -ExclusionPath "C:\Path\To\Folder"
- Disable Conflicting Software
If you have another antivirus program, try temporarily disabling it to see if it resolves the conflict. - Advanced Options
In rare cases, you might need to adjust CPU affinity for msmpeng.exe, limiting the number of CPU cores it can use. This is a more technical solution, so research it before attempting.
Important Note
Disabling real-time protection or excluding critical folders leaves your system vulnerable. These methods should only be used for troubleshooting and should be followed by fixing the underlying cause.