MsMpEng.exe
Also called msmpeng, antimalware service executable, windows defender
The Windows Defender antimalware engine. Task Manager often shows it as Antimalware Service Executable.
What you need to know
This is Windows Security scanning the PC.
Antimalware Service Executable is the Defender engine. Short CPU spikes during a scan are common. Ending it leaves the PC without the built-in malware scan.
- Safe?
- Usually yes
- Should I close it?
- Usually no
- High CPU normal?
- During a scan, yes
What is MsMpEng.exe?
MsMpEng.exe is the Microsoft Defender Antivirus engine. Task Manager labels the same work as Antimalware Service Executable.
What does it do?
It scans files, memory, and downloads against Defender signatures. It also does scheduled and on-access checks when Windows Security is on.
Why is it running?
You see it because Windows Security is the built-in antivirus on current Windows. A scan, a signature update, or a newly written file can wake it.
Is it safe?
Usually safe
The legitimate Defender engine is a normal Windows component. A file with this name outside the Windows Defender folder is not the normal copy.
A legitimate copy normally runs from:
C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MsMpEng.exe
- Expected publisher: Microsoft Corporation
- The version folder changes when Defender updates the platform
- The filename alone is not proof of safety
Can I end it?
Not recommended
Ending the engine stops live protection until Windows starts it again. That is a security gap, not a cleanup step.
Can I remove it?
No
Do not delete MsMpEng.exe. It is part of Windows Security. Removing it can leave the PC without the built-in antivirus.
Should it start with Windows?
Defender starts with Windows when Windows Security is the active antivirus. You should not remove it from startup to save a little CPU.
Normal resource behavior
These are contextual labels, not universal averages.
- CPU
- Can rise during a scan or signature update, then fall
- Memory
- Moderate while definitions are loaded
- Disk
- Can be high during a full scan
- Network
- Used for definition updates
File information
| Executable name | MsMpEng.exe |
|---|---|
| Common legitimate path | C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MsMpEng.exe |
| Publisher | Microsoft Corporation |
| Signature expectation | Signed by Microsoft Windows |
Common problems
High CPU after a download
A new installer or a large extract can trigger a scan. Wait for the scan to finish before you assume the PC is broken.
High disk on an HDD
Full scans on a spinning disk feel worse than on an SSD. That is the drive, not proof the engine is malware.
Conflicts with a second antivirus
Two live antivirus products can fight. If you installed another suite, check Windows Security for the active provider.
Troubleshooting
Diagnose before you change anything destructive.
Confirm the path and signature
Open the process properties and check that MsMpEng.exe runs from the expected folder and is signed by the expected publisher. This is the first check, not a Registry edit.
See what the process is doing
Task Manager can show CPU, memory, disk, and GPU. High use during an obvious job is often normal. High use when the PC is idle needs a closer look at the related app or service.
Avoid destructive first steps
Do not delete MsMpEng.exe, disable critical services without knowing the effect, or edit the Registry as the first move.
Technical details
Technical details
| Image name | MsMpEng.exe |
|---|---|
| Friendly name | Antimalware Service Executable |
| Related service | WinDefend |
Sources and verification
Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.
- Microsoft: Microsoft Defender Antivirus · Official Defender documentation
- Microsoft Support: Antimalware Service Executable · Public support naming
Was this article useful?
A yes or no is enough. Pick a reason if you want, or add a short note.
Thanks. That helps us improve this page.