# MsMpEng.exe

Windows Process: Microsoft Corporation

Also called msmpeng, antimalware service executable, windows defender

Windows, System Component

The Windows Defender antimalware engine. Task Manager often shows it as Antimalware Service Executable.

## What you need to know

This is Windows Security scanning the PC.

Antimalware Service Executable is the Defender engine. Short CPU spikes during a scan are common. Ending it leaves the PC without the built-in malware scan.

- **Safe?**: Usually yes

  **Should I close it?**: Usually no

  **High CPU normal?**: During a scan, yes

Feex says

If MsMpEng is busy right after you copy a big folder or install an app, that is often a scan, not a broken PC. I would let the scan finish before I hunt for malware named Defender.

## What is MsMpEng.exe?

MsMpEng.exe is the Microsoft Defender Antivirus engine. Task Manager labels the same work as Antimalware Service Executable.

## What does it do?

It scans files, memory, and downloads against Defender signatures. It also does scheduled and on-access checks when Windows Security is on.

## Why is it running?

You see it because Windows Security is the built-in antivirus on current Windows. A scan, a signature update, or a newly written file can wake it.

## Is it safe?

Usually safe

The legitimate Defender engine is a normal Windows component. A file with this name outside the Windows Defender folder is not the normal copy.

A legitimate copy normally runs from:

`C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MsMpEng.exe`

- Expected publisher: Microsoft Corporation
- The version folder changes when Defender updates the platform
- The filename alone is not proof of safety

## Can I end it?

Not recommended

Ending the engine stops live protection until Windows starts it again. That is a security gap, not a cleanup step.

## Can I remove it?

No

Do not delete MsMpEng.exe. It is part of Windows Security. Removing it can leave the PC without the built-in antivirus.

## Should it start with Windows?

Defender starts with Windows when Windows Security is the active antivirus. You should not remove it from startup to save a little CPU.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Can rise during a scan or signature update, then fall

  **Memory**: Moderate while definitions are loaded

  **Disk**: Can be high during a full scan

  **Network**: Used for definition updates

## File information

| Executable name        | MsMpEng.exe                                                                |
| ---------------------- | -------------------------------------------------------------------------- |
| Common legitimate path | C:\ProgramData\Microsoft\Windows Defender\Platform\\\<version>\MsMpEng.exe |
| Publisher              | Microsoft Corporation                                                      |
| Signature expectation  | Signed by Microsoft Windows                                                |

## Related services

The engine does the scan. WinDefend is the service contract that keeps it running.

WinDefend Windows Service

## Common problems

### High CPU after a download

A new installer or a large extract can trigger a scan. Wait for the scan to finish before you assume the PC is broken.

### High disk on an HDD

Full scans on a spinning disk feel worse than on an SSD. That is the drive, not proof the engine is malware.

### Conflicts with a second antivirus

Two live antivirus products can fight. If you installed another suite, check Windows Security for the active provider.

## Troubleshooting

Diagnose before you change anything destructive.

### Confirm the path and signature

Open the process properties and check that MsMpEng.exe runs from the expected folder and is signed by the expected publisher. This is the first check, not a Registry edit.

### See what the process is doing

Task Manager can show CPU, memory, disk, and GPU. High use during an obvious job is often normal. High use when the PC is idle needs a closer look at the related app or service.

### Avoid destructive first steps

Do not delete MsMpEng.exe, disable critical services without knowing the effect, or edit the Registry as the first move.

## Technical details

Technical details

| Image name      | MsMpEng.exe                    |
| --------------- | ------------------------------ |
| Friendly name   | Antimalware Service Executable |
| Related service | WinDefend                      |

## Related

These entities connect to this article. Type is shown on every link.

[WinDefend: Windows Service](https://feex.it/wiki/service/windows-defender)[Windows Security: Application](https://feex.it/wiki/software/windows-security)[WinDefend: Windows Service](https://feex.it/wiki/service/windows-defender)[How to read Task Manager: Guide](https://feex.it/wiki/software/system/how-to-read-task-manager)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft: Microsoft Defender Antivirus ](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows)· Official Defender documentation
- [Microsoft Support: Antimalware Service Executable ](https://support.microsoft.com/windows)· Public support naming

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: MsMpEng.exe

  **Typical path**: C:\ProgramData\Microsoft\Windows Defender\Platform\\\<version>\MsMpEng.exe

  **Related service**: WinDefend

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/msmpeng.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)