Skip go content

MpDefenderCoreService.exe

Windows ProcessMicrosoft Corporation

Awọn iwe-aṣẹ wiwa iwe-aṣẹ mpdefendercoreservice, defender core service, mdcore

WindowsSystem Component

Microsoft Defender Core Service. Na later Defender platform host wey sit beside MsMpEng.exe, no be replacement filename for di scan engine.

Wetin you need know

Dis na Defender platform service. Antimalware Service Executable na still MsMpEng.exe.

MpDefenderCoreService.exe appear as Microsoft split more Defender work commot from single engine process. To end am no dey uninstall Windows Security. E fit leave protection inconsistent until di platform restart.

E safe?
Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.
Same as MsMpEng?
No. Dat one na di engine
I suppose end am?
No be if Defender na your antivirus
Feex tok say
If I see both MsMpEng and MpDefenderCoreService, I dey treat am as current Defender platform, no be two antivirus products wey dey fight. To end only di Core service no be scan.

Wetin be MpDefenderCoreService.exe?

MpDefenderCoreService.exe na Microsoft Defender Core Service. E dey live inside di Defender platform version folder next to MsMpEng.exe.

Wetin e dey do?

E dey support platform work wey Microsoft move commot from di classic engine process. MsMpEng.exe still dey do di file scan wey people dey see as Antimalware Service Executable.

Wetin make am dey run?

Windows Security na di active antivirus and di Defender platform dey current reach to ship di Core service. Third-party suite wey disable Defender no suppose leave dis one running as di owner.

Inspect the running instance

Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm)

Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'MpDefenderCoreService.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List

No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm)

Use the file-identity guide to compare signatures and product metadata. A filename alone no fit establish safety. (pcm)

E dey safe?

Check dis running file

Di signed binary under di Windows Defender platform folder na Defender. One Core service exe for desktop no be am.

Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm)

C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MpDefenderCoreService.exe

  • Version folder dey change with di platform
  • Publisher: Microsoft Corporation
  • Sibling engine: MsMpEng.exe

I fit end am?

No advise am

To end di Core service fit stall platform tasks until Windows start am again. End scan wait by waiting, no be by killing Defender hosts.

I fit comot am?

No

No delete MpDefenderCoreService.exe. Change protection inside Windows Security, or make you allow another antivirus take di slot.

E suppose start with Windows?

Di Defender platform dey start am. E no be chat tray wey you uncheck.

Measure resource use

Measure the current process rather than assume a universal baseline
CPU and memory Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm)
Disk and network Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm)

File information

MpDefenderCoreService.exe file information
Executable name MpDefenderCoreService.exe
Recorded installation path C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MpDefenderCoreService.exe
Publisher Microsoft Corporation
Signature check Inspect the actual file; this entry no dey certify its certificate identity. (pcm)

Common wahala dem

Two Defender names dey fear people

Engine plus Core service na platform split. E no be second unpaid antivirus.

Debloat scripts dey disable di Core service

Dat one dey leave Windows Security for half state. Turn am back on if Defender still na di owner.

How to troubleshoot

Diagnose before you change anything wey fit scatter things.

Check Windows Security for di active provider

If another product own antivirus, dis service no suppose be your first hunt.

No mix am up with NisSrv

NisSrv na network inspection. MsMpEng na di scan. Dis na di Core service.

Technical details

Technical details
MpDefenderCoreService.exe technical details
Image name MpDefenderCoreService.exe
Family Microsoft Defender platform

Check the identity of running file

A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm)

Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. How we dey do research.

Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.

Dis article make sense to you?