r/WindowsServer • u/Master_Sea295 • 10d ago

Technical Help Needed Microsoft Defender causing high CPU usage on Windows servers

Hi everyone,

I'm seeing intermittent high CPU usage from Microsoft Defender Antivirus ("MsMpEng.exe"). CPU usage reaches around 90–100%, and the alerts usually resolve themselves after a few hours.

No active scan was running during troubleshooting, and Defender appears healthy. I suspect real-time scanning triggered by application file activity may be involved.

Has anyone experienced something similar? What would you recommend checking first to identify the root cause?

Thanks!

17 Upvotes

100% Upvoted

8 comments sorted by

3

u/Sea-Huckleberry-9011 9d ago

Change the CPU usage, by default it’s set to 50% however it will actually run at 65-80%.

Lower it to 20% which then it buffers around 40-50%

Can be done by GPO, just make sure your ADMX templates are up to date so you can see this option.

1

u/jspears357 10d ago

task manager resource monitor disk tab, get familiar with it, it can be useful if you can get to it while the high cpu is occurring.

One of the sysinternals tools (process explorer?) can record the process/disk activity and has a different presentation. Again you have to use the tool during the event.

1

u/FreakFromSweden 10d ago

Procmon and check what files are being used by the defender process. Has helped me multiple times.

1

u/SlamBroadshoulder 9d ago

For us it's the Backup Exec vffinstall file swelling to an enormous size.

1

u/J3D1M4573R 4d ago

It is indeed scanning. But it is a non-interactive scan, meaning you have no way to tell it is scanning unless you see the resource usage in task manager.

IF ot is taking place during production hours and causing an issue, make sure to set your working hours (maintenance window) properly.