Fix Windows Defender High CPU (MsMpEng.exe)

Yeah, I know the drill—your fan sounds like a jet engine, and Task Manager shows Windows Defender hogging 50% of your CPU for no good reason. Happens to the best of us. Let's fix it.

The Quick Fix: Reset Defender's Scan History

Most of the time, this is a corrupted scan history. The antimalware service (MsMpEng.exe) gets stuck trying to re-read a bad log or a quarantined file that no longer exists. Here's how to nuke it:

Open Windows Security (search for it in the Start menu).
Go to Virus & threat protection > Manage settings (under Virus & threat protection settings).
Scroll down to Exclusions and add the folder C:\ProgramData\Microsoft\Windows Defender temporarily. This stops Defender from scanning its own data while we work.
Open an elevated Command Prompt (right-click Start > Windows Terminal (Admin) or Command Prompt (Admin)).
Run these commands in order:

net stop windefend
rd /s /q "C:\ProgramData\Microsoft\Windows Defender\Scans"
net start windefend

That's it. The rd command deletes the entire Scans folder. Windows will recreate it fresh on the next scan. Wait a minute, then check Task Manager. CPU should drop to near zero.

If that doesn't do it, we move to the stubborn case:

When the Service Itself Is Stuck

A corrupted scan history is the common cause, but sometimes the Windows Defender Security Center service just hangs. I've seen this after a Windows update, especially on machines that were put to sleep mid-scan.

Here's the manual nuke:

Open Services (services.msc).
Find Windows Defender Security Center (or Security Center on older builds).
Right-click > Stop.
Also stop Windows Defender Antivirus Network Inspection Service and Windows Defender Antivirus Service if they're running.
Now delete the scan history again (the same folder as above). But also delete the Scans\History subfolder specifically if the whole thing won't delete.
Restart all three services. Use the command line to be safe:

net start windefend
net start SecurityHealthService
net start WdNisSvc

If the services are stuck in "Stopping" or won't start, you might need to reboot after deleting the folder. But usually the stop/delete/start sequence works.

Why This Works

Defender's scan history is a set of logs and cached signatures that it uses to skip files it's already checked. When that history gets corrupted—say, from a sudden power loss or a forced shutdown—the service tries to read a log entry that points to a file that's gone. Instead of skipping it, it goes into a loop: it keeps trying to re-scan that file, re-read that log, and fails over and over. That's your 100% CPU.

Deleting the folder forces Defender to build a fresh history from zero. It'll do a full scan on the next run, but it'll be one-and-done, not a constant spin.

Less Common Variations

Third-Party Antivirus Conflict

If you ever had Norton or McAfee installed, even if you think you uninstalled it, leftover drivers can conflict with Defender. Check for leftover services. Use the tool from the vendor to fully remove it (Norton Removal Tool, McAfee Consumer Product Removal Tool). I had a client last month whose Defender was pegged at 40% because of a leftover Norton driver from 2019.

Corrupted Threat Protection Definitions

Sometimes the problem is the definition updates themselves. If they're in a bad state, Defender will retry constantly. Update them manually:

cd "C:\Program Files\Windows Defender"
MpCmdRun.exe -SignatureUpdate

If that fails, download the latest definitions from the Microsoft Malware Protection Center and install manually.

Fast Startup Glitch

Windows 10 and 11's Fast Startup can resurrect a hung process from hibernation. Disable it:

Control Panel > Power Options > Choose what the power buttons do > Change settings that are currently unavailable > Uncheck Turn on fast startup.

Reboot. This alone fixed a client's issue who only saw the problem after booting from shutdown.

One More: Exclusions Not Working

If you added an exclusion and it didn't help, make sure you added the correct path. Use %ProgramData% instead of typing it manually. A typo will silence the exclusion.

Prevention: Keep It From Coming Back

Here's the practical stuff I tell every small business client:

Don't force shutdown your PC. If it hangs, wait a few minutes. I've seen more Defender corruption from hard resets than anything else.
Keep your system updates current. Microsoft pushes fixes for Defender's engine regularly. A stale install is a root cause.
Schedule a weekly full scan. It sounds counterintuitive, but a regular full scan keeps the history fresh and less likely to rot. Set it for a time when the machine is on but idle—like 2 AM.
If you installed third-party AV and removed it, run the vendor's removal tool to clean registry entries and drivers. Never trust the uninstaller that came with it.

I keep a batch file that deletes the Scans folder on my USB drive. It's saved me three visits to clients this year alone. Save the two commands from earlier into a .bat file and run it as admin when this crap starts. You'll thank me later.

If this didn't fix it, you're looking at a deeper issue—possibly a corrupted OS component. But trust me, 9 out of 10 times, the scan history is the culprit. I've done this on Windows 10 Pro 20H2, Windows 11 22H2, and even Server 2016. Works every time.