Fix Antimalware Service Executable High Memory Usage on Windows 10 Pro

If your laptop fans spin up like a turbo at your local servo and Task Manager shows MsMpEng.exe gulping down gigabytes of RAM, you're not alone. Plenty of folks in Sydney, Brisbane and right out in the bush have noticed Windows Defender's background service quietly eating into their system memory, especially after a big Patch Tuesday. The process in question, Antimalware Service Executable, is the engine that runs real-time protection in Windows 10 Pro, and when it gets stuck in a loop or starts scanning a massive archive, performance takes a real hit. Below is a practical walkthrough to bring its memory footprint back under control without sacrificing your security.

The trick is working with Defender rather than fighting it. Rather than disabling protection outright, you can shape how often scans run, which folders get scanned, and how much CPU the service is allowed to grab. Before diving in, it's worth remembering that Defender ties into other Microsoft services, including the family safety features covered in our separate guide, so changes here can ripple across your broader security setup.

What Is Antimalware Service Executable and Why It Is Hogging RAM

Antimalware Service Executable is the friendly name for MsMpEng.exe, a Windows Defender component that runs continuously in the background. It performs real-time scanning of files, monitors running processes, fetches new definition updates, and handles scheduled full-system scans. Because it must inspect almost every file your system touches, it has legitimate reason to use plenty of memory.

The trouble starts when memory use climbs into multi-gigabyte territory and stays there. Common culprits include outdated definition packages, an in-progress scan of a massive file such as a virtual machine image, a corrupt signature database, or a conflict with another security tool. Telstra and Optus customers who store large game libraries on Steam sometimes see spikes when Defender grinds through every executable in a download directory. Add in Australia's tendency for hot summer days — even in Hobart you cop the odd scorcher — and a CPU-bound Defender service makes the whole laptop run warmer and louder.

When the service grabs a steady 1.5 GB or more of RAM and refuses to release it, you have a genuine performance problem on your hands, not just a cosmetic blip.

Quick Wins to Free Up Memory Straight Away

Before fiddling with policies, try a few quick fixes that take only a couple of minutes. First, restart the machine. Sounds obvious, but a fresh boot clears cached scan data and lets Defender rebuild its working set. Many Aussie tradies and home-office workers leave their PCs in sleep mode for weeks, which is a recipe for stale memory.

Second, open Task Manager with Ctrl + Shift + Esc and end any leftover MsMpEng.exe trees that show more than one instance. A single healthy instance is fine, but two or three indicate a stuck scan. Third, check for and install the latest Windows updates. Microsoft regularly ships performance fixes for Defender through Windows Update, and these patches often calm the memory churn. Open Settings, head to Update and Security, and run a manual check. On a flaky NBN connection this can take longer than you'd like, so grab a flat white while it churns.

Finally, run a full scan in Defender and let it finish. A half-completed scan leaves orphaned file handles that the service holds onto, which keeps memory reserved indefinitely.

Adjust Windows Defender Scheduled Scan Behaviour

Defender runs a quick check during low-usage hours and a deeper scan on a weekly cadence by default. On a system already running near memory limits, these automatic scans can be the straw that breaks the camel's back. The fix is to either drop the scan frequency or push it to a time when you genuinely won't be using the PC.

Open Task Scheduler and navigate to Microsoft, then Windows, then Windows Defender. Double-click Windows Defender Scheduled Scan and untick Run with highest privileges, which stops the scan from hogging all CPU cores. Next, head into Settings, Update and Security, Windows Security, Virus and Threat Protection, and click Manage settings under Virus and Threat Protection settings. Scroll to Exclusions and add your project folders, download stash, or any large media archive.

If you only use Defender for real-time protection and prefer to run manual scans once a fortnight, you can disable the scheduled scan entirely through the same Task Scheduler entry. For most Australian households running on Aussie Broadband or TPG connections with monthly data caps, a manual approach actually makes more sense.

Cap CPU and Memory Through Group Policy and Registry

Defender normally lets itself use up to 50% of your processor at peak, but it can spike higher when scanning large files. You can rein that in through Group Policy, even on Windows 10 Pro. Press Win + R, type gpedit.msc and navigate to Computer Configuration, Administrative Templates, Windows Components, Microsoft Defender Antivirus. Look for the setting that limits CPU usage during scans and set a percentage cap — 20% is a reasonable starting point that keeps scans running without freezing your browser.

For users on Windows 10 Home without Group Policy, the Registry Editor offers the same control. Open regedit, navigate to HKLM\SOFTWARE\Policies\Microsoft\Windows Defender, and create a DWORD called AvgCPULoadFactor with a decimal value between 10 and 50. Restart the service or reboot for the change to take effect.

These edits don't reduce the memory Defender has already reserved; they cap how much additional CPU it can claim while scanning, which indirectly stops memory pressure from worsening during long jobs. Fair dinkum, the difference is noticeable within an hour.

Add Smart Folder and Process Exclusions for Defender

Exclusions tell Defender to skip certain paths, file types, or processes. Misuse of exclusions is risky because it creates blind spots for malware, but thoughtful exclusions for trusted, static content dramatically cut memory pressure. Game install folders, software repositories, video editing scratch disks, and development trees are sensible candidates.

Add exclusions in Windows Security under Virus and Threat Protection settings. You can exclude folders, file types, or running processes. Be conservative — exclude only what you fully control and trust. Plenty of Melburnians working from home on Unreal Engine projects see massive relief by excluding their Projects folder, since every texture and asset was being re-scanned on each save.

Whatever you exclude, document it. A short text file in your Documents folder listing excluded paths helps when troubleshooting later, and it stops a colleague or family member from accidentally downloading something dodgy into a trusted zone.

Repair System Files and Clear Out Windows Update Issues

Sometimes high memory use is a symptom of deeper corruption rather than Defender itself. Run the built-in System File Checker and the Deployment Image Servicing and Management tool to repair any inconsistencies. Open an elevated Command Prompt and run sfc /scannow, then DISM /Online /Cleanup-Image /RestoreHealth. The DISM step uses Windows Update as its source, so make sure your connection is healthy — a stable iiNet or Telstra link will save you an arvo of frustration.

After the repairs, clear the Windows Update cache by stopping the Windows Update service, renaming the SoftwareDistribution folder to SoftwareDistribution.old, and restarting the service. Stalled downloads force Defender to repeatedly verify partial files, which keeps memory pinned high. The ACCC's recent guidance on consumer guarantees also reminds us that a machine in good working order should not silently chew through resources, and these maintenance steps keep your setup in line with that expectation.

When All Else Fails, Reinstall or Reset Defender

If nothing else brings memory use down, you can reset Defender to its factory state. Run PowerShell as administrator and execute Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage, then re-register the Defender module using a fresh install command from Microsoft's documentation. The process restores default scan settings, clears exclusions, and removes accumulated junk in the protection history.

Should Defender still misbehave after a reset, consider whether a competing antivirus might serve you better. Plenty of Aussies running older hardware in regional Queensland or Western Australia find that a lightweight third-party engine uses less RAM than Defender's full suite. That said, switching off Defender entirely leaves a gap in your security, so weigh the trade-off carefully.

If your machine is still under warranty or you bought it through JB HiFi, you can also book a free diagnostic at an authorised Microsoft service centre, which comes in handy when the issue points to hardware faults like a failing SSD rather than software. Long-term, swapping in a bigger stick of RAM or moving to a solid-state drive gives Defender more headroom without any of the fiddling.

A lean Defender service is the goal, not a disabled one. Run through the steps above in order, reboot between major changes, and keep an eye on Task Manager to confirm the memory footprint has dropped back to a steady 200 to 400 MB. Bookmark the related guides on Windows10Pro.net for more tweaks, and set aside a quiet afternoon to tidy up your security stack while your machine finally runs cool and quiet.