Antimalware Service Executable takes high system memory, especially when Windows Defender’s Virus & threat protection is running a scan. While it releases the memory once the scan completes, you may notice a significant drop in performance during this process.
Although you cannot end this task since it is a system process, you can stop the scan and release the memory. If Windows Defender is not performing any scan, features like Real-time protection or cloud-delivered protection might still cause the process to take high memory resources.
Disabling these features should, in theory, stop the high memory usage. If it does not resolve the issue, there are a few things you’re able to try to fix the problem with high memory usage.
Before that, let’s know a little about this background process.
What is Antimalware Service Executable?
Antimalware Service Executable (MsMpEng.exe) is a system application that automatically runs on startup if you do not have any third-party antivirus application installed.
Once the system turns on, theWindows Defender antiviruswill run a quick scan which can result in the Antimalware Service Executable consuming high resources for a couple of minutes.
If it is not running any scan, the background process should take about 150 MB to 200MB of memory resources. This number should not go higher than 300MB on idle conditions. If it is, we recommend that you start by checking Virus & threat protection.
Check Virus & Threat Protection
Windows Defender and its background process and services use a high CPU, memory, Disk, andCPU resourceswhen it scans the PC. This number is even higher when it is running a full scan.
You can simply cancel the scanning process to lower memory, CPU, and disk resource usage.
Once you cancel the scan, check if Antimalware Service Executable uses lower system resources. This number should decrease gradually and after some time, Windows Defender’s CPU and Disk usage will be close to 0, and its memory usage should stay around 150 MB to 300 MB.
Disable Virus & Threat Protection Features
If the system is not running any scan, but the Antimalware background process is still using high memory usage, it might be using features included in Virus & Threat protection.
These features include locating and scanning new files on the system, providing protection to data in the cloud, and sending sample files to protect the system from potential threats.
you may disable them to lower system resources, but this will leave your system vulnerable.
Even if you turn off Real Time protection, Windows automatically enables it when you restart the system. However, you can permanently disable Real-time protection.
Before you can disable Real-time protection permanently, ensure that Tamper Protection is disabled.
Update Windows
MsMpEng.exe(Microsoft Malware Protection Engine) had a significant performance issue where it uses unreasonably high computation when the Real-time protection feature is active. This simultaneously causes high system resource usage, especially when using browsers like Firefox.
Fortunately, Microsoft pushed a patch update that fixed thempengine.dllfile in Security Intelligence update version 1.387.695.0 on May 09, 2025. you may install this update to fix the issue with Antimalware service executable high memory usage.
Add Exclusion
Users in numerous online forums have also reported that adding theMsMpEng.exefile to the exclusion list in Windows Defender fixed the issue for them. To add Microsoft Malware Protection Engine to exclusion,
Change Scheduled Scan Properties
Your system can automatically start the Windows Defender scan if the process is scheduled to runvia the Task Scheduler. On top of that, Windows runs the scan with the highest priority. This enables Windows Defender services and background processes to use higher system resources.
Tweaking Defender’s task scheduler properties allows the user to control when the system runs Windows Defender scheduled scan and even lower its priorities.
Disable Virus & Threat Protection
Finally, if none of the solutions work, you can try disabling the entire Virus and threat protection. When youdisable Virus and threat protection, it will not use any background process or defender services such as the Antivirus Service.
Disabling the Virus and Threat Protection makes your entire system vulnerable to malware attacks. So make sure that youinstall a separate antivirus applicationonce you disable Windows Defender.
If you are installing a third-party application, the OS will automatically disable Virus and Threat protection feature and use the installed antivirus application.
