What Is Antimalware Service Executable (MsMpEng.exe)?

• Antimalware Service Executable is Microsoft Defender Antivirus, the antivirus that comes with Windows 10, Windows 11 and Windows Server.
• The same process shows up under three names in Task Manager: Antimalware Service Executable, MsMpEng.exe and Microsoft Defender Antivirus.
• High CPU use usually means it is scanning. Microsoft says a full scan can take a few hours or days, depending on the amount and type of data.
• Microsoft says not to disable, stop or modify the Defender services, because that can cause severe instability and leave the device vulnerable.
• If you install a compatible non-Microsoft antivirus, Microsoft says Defender Antivirus turns itself off automatically.
• The safer fixes Microsoft documents for home PCs are scheduling scans for when you are not using the PC and, only for files you trust, adding a narrow exclusion.

Table: How Microsoft Defender Antivirus appears in Windows Task Manager, as Microsoft documents it.

What is Antimalware Service Executable?#

Antimalware Service Executable is the running process of Microsoft Defender Antivirus. Microsoft describes Defender Antivirus as built into Windows and available in Windows 10, Windows 11 and Windows Server.

The process does two kinds of work:

• Real-time protection: Microsoft says it reviews files when they are opened and closed, and whenever you navigate to a folder.
• Scans: quick scans, full scans, custom scans and the Microsoft Defender Antivirus (offline) scan, run on a schedule or when you start one in the Windows Security app.

Is Antimalware Service Executable safe?#

Yes. It is part of Windows, not malware. Microsoft's own instructions for confirming that Defender Antivirus is running tell you to look for MsMpEng.exe on the Details tab of Task Manager.

If you want to confirm which antivirus is in charge:

1. Open the Windows Security app from the Start menu.
2. Select Virus & threat protection.
3. Under Who's protecting me?, choose Manage Providers to see which antivirus is protecting the device.

If you are worried about a specific file or folder, Microsoft says you can right-click it in File Explorer and select Scan with Microsoft Defender.

Why does Antimalware Service Executable use so much CPU?#

It is usually scanning. Microsoft says a full scan checks every file and program on the device and can take a few hours or days, depending on the amount and type of data. A quick scan checks processes, memory, profiles and certain locations on the device.

Microsoft lists these common reasons for higher CPU use by Defender Antivirus:

Table: Common reasons for higher Microsoft Defender Antivirus CPU use, from Microsoft Learn.

Microsoft's detailed CPU troubleshooting guide is written for IT administrators who manage many PCs. On a home PC, the steps below are the ones Microsoft documents in the Windows Security app.

How do I reduce Antimalware Service Executable CPU use safely?#

Keep Defender on and change when and what it scans. Microsoft documents these options for home users:

1. Let the scan finish. Microsoft says Defender Antivirus scans the device regularly and tries to do it while you are not using the PC.
2. Schedule the scan for a time you are away. In Task Scheduler, go to Task Scheduler Library > Microsoft > Windows > Windows Defender, open Windows Defender Scheduled Scan, then on the Triggers tab choose New and pick a time.
3. Prefer quick scans. Microsoft says a quick scan is sufficient in most cases and is the recommended option for scheduled scans, and that it generally doesn't recommend scheduling full scans.
4. Exclude only files you trust, and only if you must. Microsoft says an exclusion for a single file or folder is safer than turning protection off, but warns that excluded files are no longer checked, which could leave the device vulnerable. Process exclusions apply to real-time scanning, and Microsoft advises using the full path.

Can I turn off Antimalware Service Executable?#

Microsoft advises against it. Microsoft says not to disable, stop or modify the services Defender Antivirus uses, because doing so can cause severe instability and leave the device vulnerable. The Windows Security app lets you turn real-time protection off only temporarily, and Microsoft says it turns back on automatically after a short while.

The supported way Defender steps aside is when another antivirus takes over:

Table: Microsoft Defender Antivirus modes, from Microsoft Learn.

Microsoft adds that on Windows 11 with Smart App Control on, Defender may show passive mode instead of disabled mode, and that it can turn itself back on automatically if the other antivirus expires, is uninstalled or stops providing real-time protection.

FAQ#

Is Antimalware Service Executable a virus?#

No. Antimalware Service Executable is the Task Manager name for Microsoft Defender Antivirus, the antivirus built into Windows 10, Windows 11 and Windows Server. Its file is MsMpEng.exe.

What is MsMpEng.exe?#

MsMpEng.exe is the Microsoft Defender Antivirus process. Microsoft says Task Manager shows it as Antimalware Service Executable on the Processes tab and as MsMpEng.exe on the Details tab.

Why is Antimalware Service Executable using so much CPU?#

It is usually scanning. Microsoft says real-time protection reviews files when they are opened and closed, and a full scan can take a few hours or days depending on how much data there is. Unsigned programs, complex file formats and obfuscated scripts can also raise CPU use.

Can I end or disable Antimalware Service Executable?#

Microsoft advises against it. Microsoft says not to disable, stop or modify the Microsoft Defender Antivirus services, because doing so can cause severe instability and leave the device vulnerable.

Does Antimalware Service Executable run if I install another antivirus?#

On Windows 10 and Windows 11 PCs at home, Microsoft says Microsoft Defender Antivirus turns itself off automatically when you install a compatible non-Microsoft antivirus program, and can turn back on if that program expires or is uninstalled.

How do I check that Microsoft Defender Antivirus is the active antivirus?#

Open Windows Security, select Virus & threat protection, and under Who's protecting me? choose Manage Providers to see which antivirus is protecting the device.

Compare further#

• McAfee vs Norton
• ESET vs Kaspersky

Sources#

• Microsoft Learn: Microsoft Defender Antivirus in Windows overview
• Microsoft Learn: Microsoft Defender Antivirus compatibility with other security products
• Microsoft Learn: Troubleshoot performance issues related to Microsoft Defender Antivirus
• Microsoft Learn: Configure scheduled quick or full Microsoft Defender Antivirus scans
• Microsoft Support: Virus and threat protection in the Windows Security app
• Microsoft Support: Stay protected with the Windows Security app
• Microsoft Support: Schedule a scan in Microsoft Defender Antivirus