# MpDefenderCoreService.exe Windows Process: Microsoft Corporation Awọn iwe-aṣẹ wiwa iwe-aṣẹ mpdefendercoreservice, defender core service, mdcore Windows, System Component Microsoft Defender Core Service. Na later Defender platform host wey sit beside MsMpEng.exe, no be replacement filename for di scan engine. ## Wetin you need know Dis na Defender platform service. Antimalware Service Executable na still MsMpEng.exe. MpDefenderCoreService.exe appear as Microsoft split more Defender work commot from single engine process. To end am no dey uninstall Windows Security. E fit leave protection inconsistent until di platform restart. - **E safe?**: Check the running file path, signature, and publisher. Name alone no fit confirm say e safe. **Same as MsMpEng?**: No. Dat one na di engine **I suppose end am?**: No be if Defender na your antivirus Feex tok say If I see both MsMpEng and MpDefenderCoreService, I dey treat am as current Defender platform, no be two antivirus products wey dey fight. To end only di Core service no be scan. ## Wetin be MpDefenderCoreService.exe? MpDefenderCoreService.exe na Microsoft Defender Core Service. E dey live inside di Defender platform version folder next to MsMpEng.exe. ## Wetin e dey do? E dey support platform work wey Microsoft move commot from di classic engine process. MsMpEng.exe still dey do di file scan wey people dey see as Antimalware Service Executable. ## Wetin make am dey run? Windows Security na di active antivirus and di Defender platform dey current reach to ship di Core service. Third-party suite wey disable Defender no suppose leave dis one running as di owner. ## Inspect the running instance Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm) `Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'MpDefenderCoreService.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List` No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm) Use the [file-identity guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/) to compare signatures and product metadata. A filename alone no fit establish safety. (pcm) ## E dey safe? Check dis running file Di signed binary under di Windows Defender platform folder na Defender. One Core service exe for desktop no be am. Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm) `C:\ProgramData\Microsoft\Windows Defender\Platform\\MpDefenderCoreService.exe` - Version folder dey change with di platform - Publisher: Microsoft Corporation - Sibling engine: MsMpEng.exe ## I fit end am? No advise am To end di Core service fit stall platform tasks until Windows start am again. End scan wait by waiting, no be by killing Defender hosts. ## I fit comot am? No No delete MpDefenderCoreService.exe. Change protection inside Windows Security, or make you allow another antivirus take di slot. ## E suppose start with Windows? Di Defender platform dey start am. E no be chat tray wey you uncheck. ## Measure resource use | CPU and memory | Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm) | | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | Disk and network | Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm) | ## File information | Executable name | MpDefenderCoreService.exe | | -------------------------- | ---------------------------------------------------------------------------------------- | | Recorded installation path | C:\ProgramData\Microsoft\Windows Defender\Platform\\\\MpDefenderCoreService.exe | | Publisher | Microsoft Corporation | | Signature check | Inspect the actual file; this entry no dey certify its certificate identity. (pcm) | ## Common wahala dem ### Two Defender names dey fear people Engine plus Core service na platform split. E no be second unpaid antivirus. ### Debloat scripts dey disable di Core service Dat one dey leave Windows Security for half state. Turn am back on if Defender still na di owner. ## How to troubleshoot Diagnose before you change anything wey fit scatter things. ### Check Windows Security for di active provider If another product own antivirus, dis service no suppose be your first hunt. ### No mix am up with NisSrv NisSrv na network inspection. MsMpEng na di scan. Dis na di Core service. ## Technical details Technical details | Image name | MpDefenderCoreService.exe | | ---------- | --------------------------- | | Family | Microsoft Defender platform | ## Check the identity of running file A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm) ## Related Dis entities connect to dis article. Type dey show for every link. [MsMpEng.exe: Windows Process](https://feex.it/wiki/l/pcm/process/msmpeng.exe/)[NisSrv.exe: Windows Process](https://feex.it/wiki/l/pcm/process/nissrv.exe/)[Windows Defender: Windows Service](https://feex.it/wiki/l/pcm/service/windows-defender/)[Windows Security: Application](https://feex.it/wiki/l/pcm/software/windows-security/)[Check an executable path and digital signature: Guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/)[Read Task Manager and compare process activity: Guide](https://feex.it/wiki/l/pcm/software/system/how-to-read-task-manager/)[Security processes: Category](https://feex.it/wiki/process/security/) ## Sources and verification Recorded source label: August 2026. Dis label no establish independent verification. [How we dey do research](https://feex.it/wiki/research/). - [Microsoft Learn: Defender Antivirus ](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows)· Platform components - [Microsoft Learn: Defender updates ](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-updates)· Platform version folder - [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on top Windows PCs. No be lab benchmark. - [Microsoft Sysinternals: Sigcheck ](https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck)· Dey explain how to check file signatures. Dis reference no establish the identity or safety of any particular running file. - [Microsoft: Get-CimInstance ](https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance)· Read-only local process-query method. (pcm) - [Microsoft: Win32_Process properties ](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-process)· Documents process IDs, executable paths, creation dates and parent-ID reuse. (pcm) ## Dis article make sense to you? Yes or no dey enough. Choose reason if you want, or add short note. Quick facts The short identity of dis page. Specs, sources, and the full story still dey inside the article. - **Type**: Windows Process **Publisher**: Microsoft Corporation **Executable**: MpDefenderCoreService.exe **Typical path**: C:\ProgramData\Microsoft\Windows Defender\Platform\\\\MpDefenderCoreService.exe **Record context**: Feex Wiki reference entry **Related process**: [MsMpEng.exe](https://feex.it/wiki/l/pcm/process/msmpeng.exe/) Recorded source status: Feex Reviewed: Recorded source label: August 2026. Dis label no establish independent verification. --- Source: [Canonical Feex Wiki page](https://feex.it/wiki/l/pcm/process/mpdefendercoreservice.exe/) [Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)