Resolving Microsoft Defender Antivirus High CPU Usage: A Practical Guide

Explore Our Microsoft Cloud Security Training →

Introduction

In this blog post, we will discuss how to address endpoint performance issues caused by high CPU usage from Microsoft Defender Antivirus (MDE). We’ll cover strategies for identifying the root cause and implementing targeted solutions without compromising security.

Identifying High MsMpEng CPU Usage

To begin troubleshooting, you should first identify processes causing high CPU usage from the MsMpEng service. Use tools such as Task Manager or Performance Monitor to monitor system performance and find the offending process.

Utilizing Performance Analyzer

For a deeper analysis, you can leverage the PowerShell cmdlet New-MpPerformanceRecording. This command captures a 5 to 10 minute trace during high CPU usage. Afterward, use Get-MpPerformanceReport to analyze the data and identify top contributing processes and files.

Strategic Exclusion Strategy

Once you’ve identified the genuine cause of high CPU usage, add targeted exclusions. Never blanket-exclude entire program directories as this could weaken security. For developer workstations, consider excluding specific build output folders and Continuous Integration (CI) tool processes.

Real-time Protection vs Scheduled Scan Impact

Real-time protection and scheduled scans can impact system performance. Adjusting scan settings or scheduling scans during off-peak hours may help minimize performance issues.

Tamper Protection Considerations

When troubleshooting, Tamper Protection may block modifications to MDE settings. To test changes, use MDE’s troubleshooting mode (a 4-hour limited window) to bypass Tamper Protection and safely implement adjustments.

Conclusion

By understanding how to diagnose and resolve high CPU usage from Microsoft Defender Antivirus, you can ensure optimal endpoint performance while maintaining security. For more in-depth training on Microsoft cloud security and other IT technologies, consider enrolling in ITP Training courses.

Explore Our Microsoft Cloud Security Training →