MpDefenderCoreService.exe
Also called mpdefendercoreservice, defender core service, mdcore
Microsoft Defender Core Service. It is a later Defender platform host that sits beside MsMpEng.exe, not a replacement filename for the scan engine.
What you need to know
This is a Defender platform service. Antimalware Service Executable is still MsMpEng.exe.
MpDefenderCoreService.exe appeared as Microsoft split more Defender work out of a single engine process. Ending it does not uninstall Windows Security. It can leave protection inconsistent until the platform restarts.
- Safe?
- Yes, with Defender
- Same as MsMpEng?
- No. That one is the engine
- Should I end it?
- Not if Defender is your antivirus
What is MpDefenderCoreService.exe?
MpDefenderCoreService.exe is Microsoft Defender Core Service. It lives in the Defender platform version folder next to MsMpEng.exe.
What does it do?
It supports platform work that Microsoft moved out of the classic engine process. MsMpEng.exe still does the file scan people see as Antimalware Service Executable.
Why is it running?
Windows Security is the active antivirus and the Defender platform is current enough to ship the Core service. A third-party suite that disabled Defender should not leave this running as the owner.
Is it safe?
Usually safe
The signed binary under the Windows Defender platform folder is Defender. A Core service exe on the desktop is not.
A legitimate copy normally runs from:
C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MpDefenderCoreService.exe
- Version folder changes with the platform
- Publisher: Microsoft Corporation
- Sibling engine: MsMpEng.exe
Can I end it?
Not recommended
Ending the Core service can stall platform tasks until Windows starts it again. End a scan wait by waiting, not by killing Defender hosts.
Can I remove it?
No
Do not delete MpDefenderCoreService.exe. Change protection in Windows Security, or let another antivirus take the slot.
Should it start with Windows?
The Defender platform starts it. It is not a chat tray you uncheck.
Normal resource behavior
These are contextual labels, not universal averages.
- CPU
- Usually lower than a full MsMpEng scan
- Memory
- Moderate
- Disk
- Low to moderate during platform work
- Network
- Definition and platform updates
File information
| Executable name | MpDefenderCoreService.exe |
|---|---|
| Common legitimate path | C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MpDefenderCoreService.exe |
| Publisher | Microsoft Corporation |
| Signature expectation | Signed by Microsoft Windows |
Common problems
Two Defender names scare people
Engine plus Core service is a platform split. It is not a second unpaid antivirus.
Debloat scripts disable the Core service
That leaves Windows Security in a half state. Turn it back on if Defender is still the owner.
Troubleshooting
Diagnose before you change anything destructive.
Check Windows Security for the active provider
If another product owns antivirus, this service should not be your first hunt.
Do not mix it up with NisSrv
NisSrv is network inspection. MsMpEng is the scan. This is the Core service.
Technical details
Technical details
| Image name | MpDefenderCoreService.exe |
|---|---|
| Family | Microsoft Defender platform |
Sources and verification
Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.
- Microsoft Learn: Defender Antivirus · Platform components
- Microsoft Learn: Defender updates · Platform version folder
- Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.
Was this article useful?
A yes or no is enough. Pick a reason if you want, or add a short note.
Thanks. That helps us improve this page.