Windows Defender Service constantly at 20% CPU usage after re-installing Windows 10

After 3 years of using my laptop, I decided it’s time to format and reinstall Windows 10 from scratch. Everything went smooth, no issues. However I noticed in the task manager that the process “Antimalware Service Executable - Windows Defender Antivirus Service”, is constantly at 20% CPU usage. Looking at the resource monitor, the file is called MsMpEng.exe

First I thought it’s just an initial scan after the new installation of Windows. But now it’s been 5 days later, been working on the laptop each day for about 12-16 hours, restarted multiple times per day, and no matter what, it’s always at 20% CPU usage. Even when I go to bed and leave the laptop on, 7 hours later, it’s still at 20%.

After a restart it takes about 5-10 minutes until the process Windows Defender Service starts to be at 20%.

It’s a fresh installed legal and activated version of Windows 10 home.

Very little software has been installed so far, and I have very little files in my document folders. No external hard drives or USB sticks attached.

Checking the antivirus options, it does not show that it’s scanning, so I don’t know why it’s constantly at 20%.

Deactivating Real-time Windows Defender protection also makes no difference. If I disable it, it’s still at 20% CPU usage.

Also I can’t end nor stop the task in Task Manager, it tells me Access Denied, even as admin.

As I said, this is not just a short period that it’s at 20%. It’s constantly at 20% for the past 5 days. This has not been the case before I formatted my laptop.


After monitoring task manager and the resource monitor, I also noticed the Disk Usage jumps every few seconds to 30MB/s - 80MB/s from the process Defender Antivirus Service (MsMpEng.exe) and "service".

Even though I just restarted and have no apps open (apart from the regular background apps), "service" is constantly writing to "C:\Windows\Temp" creating files that are several 100MB big. The disk activity created by "service" is constantly at 100KB/s - 500KB/s, reading and writing to the Temp folder.

MsMpEng.exe has two processes running and is constantly reading and writing to C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal and C:\$LogFile (NTFS Volume Log) with 10-50KB/s.

This seems strange behavior because it also occurs when I restart the laptop and don't open a single program.
Adding the folder "C:\ProgramData\Microsoft\Windows Defender\" to the exclusion list of Windows Defender seems to have done the job.

Open up Window Defender Security Center -> Virus & Thread Protection -> Virus & Thread Protection Settings -> Exclusions -> Add or remove exclusion -> Add Folder -> ""C:\ProgramData\Microsoft\Windows Defender\"

Restart PC.

37 people found this reply helpful


Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.


Question Info

Last updated January 17, 2021 Views 17,929 Applies to: