Windows 10 · Windows
How to Reduce Antimalware Service Executable CPU Use
Source-checked About 10 minutes
Answer
First confirm in Task Manager that Antimalware Service Executable is busy during a Microsoft Defender scan. Let a short scan finish, install Windows and security intelligence updates, and schedule scans for idle time. Do not disable Defender or exclude broad folders just to reduce CPU use. Administrators can use Microsoft's Defender performance analyzer when usage remains abnormal.
Confirm Defender is using the CPU
Open Task Manager and confirm Antimalware Service Executable is the process using CPU. Note whether Windows Security shows an active scan and how long the activity lasts; brief increases during scanning are expected.
Update Windows and Defender
Install current Windows updates. In Windows Security > Virus & threat protection > Protection updates, check for security intelligence updates, then restart if Windows requests it.
Let the current scan complete
Save work, close unnecessary programs, and allow a current quick or full scan to complete. Restarting the scan repeatedly can extend the period of high resource use.
Schedule scans for idle time
Open Task Scheduler, then Task Scheduler Library > Microsoft > Windows > Windows Defender. Open Windows Defender Scheduled Scan, select Triggers, and choose a time when the PC is normally on but not in active use.
Measure persistent scan-related usage
If CPU use stays high across completed scans, an administrator can run New-MpPerformanceRecording and analyze it with Get-MpPerformanceReport to identify expensive files or processes before changing policy.
Keep protection enabled
Confirm Virus & threat protection remains active. Create a narrow exclusion only when the software owner and Microsoft guidance establish that it is safe and necessary; never exclude an entire user, downloads, or system folder to improve speed.
Video walkthrough
If it does not work
- Manual scans can use more CPU than scheduled scans, and scan CPU policy is guidance rather than a hard cap.
- If high CPU continues when no scan is active, collect the process name and timestamps and investigate that separate performance problem instead of weakening antivirus protection.
Sources and verification
Checked against official documentation on . Scope: Windows.
Replaced unsafe exclusion and bypass advice with current Microsoft scan scheduling and performance-analysis guidance.