After 3 years of using my laptop, I decided it’s time to format and reinstall Windows 10 from scratch. Everything went smooth, no issues. However I noticed in the task manager that the process “Antimalware Service Executable - Windows Defender Antivirus Service”, is constantly at 20% CPU usage. Looking at the resource monitor, the file is called MsMpEng.exe

First I thought it’s just an initial scan after the new installation of Windows. But now it’s been 5 days later, been working on the laptop each day for about 12-16 hours, restarted multiple times per day, and no matter what, it’s always at 20% CPU usage. Even when I go to bed and leave the laptop on, 7 hours later, it’s still at 20%.

After a restart it takes about 5-10 minutes until the process Windows Defender Service starts to be at 20%.

It’s a fresh installed legal and activated version of Windows 10 home.

Very little software has been installed so far, and I have very little files in my document folders. No external hard drives or USB sticks attached.

Checking the antivirus options, it does not show that it’s scanning, so I don’t know why it’s constantly at 20%.

Deactivating Real-time Windows Defender protection also makes no difference. If I disable it, it’s still at 20% CPU usage.

Also I can’t end nor stop the task in Task Manager, it tells me Access Denied, even as admin.

As I said, this is not just a short period that it’s at 20%. It’s constantly at 20% for the past 5 days. This has not been the case before I formatted my laptop.


After monitoring task manager and the resource monitor, I also noticed the Disk Usage jumps every few seconds to 30MB/s - 80MB/s from the process Defender Antivirus Service (MsMpEng.exe) and "service".

Even though I just restarted and have no apps open (apart from the regular background apps), "service" is constantly writing to "C:\Windows\Temp" creating files that are several 100MB big. The disk activity created by "service" is constantly at 100KB/s - 500KB/s, reading and writing to the Temp folder.

MsMpEng.exe has two processes running and is constantly reading and writing to C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal and C:\$LogFile (NTFS Volume Log) with 10-50KB/s.

This seems strange behavior because it also occurs when I restart the laptop and don't open a single program.


Adding the folder "C:\ProgramData\Microsoft\Windows Defender\" to the exclusion list of Windows Defender seems to have done the job.

Open up Window Defender Security Center -> Virus & Thread Protection -> Virus & Thread Protection Settings -> Exclusions -> Add or remove exclusion -> Add Folder -> ""C:\ProgramData\Microsoft\Windows Defender\"

Restart PC.

  • Omg that is MAGIC! I did not even need to reboot, it was an instantaneous fix! Why do you think that worked? Any source? – Millemila Jan 21 '20 at 2:37
  • @Aedan Tried that but unfortunatly it didn't work for me. Any other options? – RobZ Mar 27 at 11:43
  • @ RobZ Unfortunately not. However a year later I did format and reinstall Windows 10 again and this time around I never had the issue. Maybe formating and reinstalling Windows 10 helps? If you do so, try redownloading it and installing it on a new USB stick. – Aedan Mar 28 at 20:10

On my machine, Defender was constantly scanning Veeam Logfiles. Adding c:\ProgramData\Veeam - Folder to the exclusion list calmed it down immediately.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.