The Antimalware Service Executable (MsMpEng.exe) is a core background process of Microsoft Defender Antivirus in Windows 11. It continuously scans files, monitors your system for malware, and provides real-time protection against viruses, ransomware, spyware, and other security threats. While this service plays a vital role in keeping your PC secure, some users notice that it occasionally consumes high CPU, memory, or disk resources, especially during scheduled scans or while downloading and installing updates.
If your computer slows down because of Antimalware Service Executable or you prefer using a third-party antivirus solution, you may want to disable or limit its activity. However, doing so removes an important layer of protection, so you should only disable it if you understand the security implications or have another antivirus program installed.
This guide explains multiple methods to disable Antimalware Service Executable in Windows 11. It also covers temporary and permanent options, along with safer alternatives that reduce resource usage without completely turning off Microsoft Defender.
What Is Antimalware Service Executable?
Antimalware Service Executable is the primary process used by Microsoft Defender Antivirus. The executable file is named MsMpEng.exe and runs in the background whenever Microsoft Defender is active.
Its responsibilities include:
- Real-time virus protection
- Malware detection
- File scanning
- Scheduled security scans
- Cloud-based protection
- Ransomware monitoring
- Automatic security updates
Because it continuously monitors system activity, it may occasionally use noticeable system resources.
Why Do Users Disable Antimalware Service Executable?
There are several reasons users choose to disable this process.
Common reasons include:
- High CPU usage
- High RAM consumption
- Excessive disk activity
- Slower gaming performance
- Software development requiring faster file access
- Using another antivirus program
- Troubleshooting system performance problems
If Microsoft Defender is your only antivirus, disabling it is generally not recommended.
Things to Know Before Disabling It
Before proceeding, consider the following:
- Your PC will become more vulnerable to malware.
- Real-time virus protection will stop working.
- Scheduled scans may no longer run.
- Downloaded files won’t be scanned automatically.
- Windows Security may display warning messages.
For most users, reducing Defender’s activity is safer than completely disabling it.
Method 1: Turn Off Real-Time Protection
This method temporarily disables Microsoft Defender.
Press Windows + I to open Settings.
Click Privacy & Security.
Select Windows Security.
Click Virus & threat protection.
Choose Manage settings.
Turn off:
- Real-time protection
Confirm the User Account Control prompt if requested.
Windows disables real-time scanning until the next restart or until you manually turn it back on.
Method 2: Disable Microsoft Defender Using Group Policy
This method is available in Windows 11 Pro, Enterprise, and Education editions.
Press Windows + R.
Type:
gpedit.msc
Press Enter.
Navigate to:
Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus
Double-click Turn off Microsoft Defender Antivirus.
Select Enabled.
Click Apply.
Click OK.
Restart your computer.
If Tamper Protection is enabled, you may need to disable it first before this policy takes effect.
Method 3: Disable Tamper Protection
Tamper Protection prevents unauthorized changes to Microsoft Defender.
Open Windows Security.
Select Virus & threat protection.
Click Manage settings.
Locate Tamper Protection.
Turn it Off.
Once disabled, advanced methods such as Group Policy or Registry changes become more effective.
You can enable Tamper Protection again later after making your changes.
Method 4: Disable Microsoft Defender Using Registry Editor
This method is intended for advanced users.
Press Windows + R.
Type:
regedit
Press Enter.
Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
If the Windows Defender key doesn’t exist, create it.
Right-click the right pane.
Choose New > DWORD (32-bit) Value.
Name it:
DisableAntiSpyware
Set its value to:
1
Close Registry Editor.
Restart Windows.
Note that newer versions of Windows 11 may ignore this registry value, especially when Tamper Protection is enabled.
Method 5: Install a Third-Party Antivirus
One of the safest ways to disable Antimalware Service Executable is by installing another antivirus program.
When Windows detects a compatible antivirus solution, Microsoft Defender usually disables its real-time protection automatically.
This allows another antivirus to take over without leaving your system unprotected.
Method 6: Disable Scheduled Scans
If the high CPU usage occurs only during scans, you can disable scheduled scanning tasks instead of turning off Defender entirely.
Search for Task Scheduler.
Open the application.
Navigate to:
Task Scheduler Library > Microsoft > Windows > Windows Defender
You may see tasks such as:
- Windows Defender Cache Maintenance
- Windows Defender Cleanup
- Windows Defender Scheduled Scan
- Windows Defender Verification
Right-click the scheduled scan task.
Choose Disable.
This reduces automatic scanning but does not completely disable Defender.
Method 7: Exclude Large Folders from Scanning
If Antimalware Service Executable uses high CPU while scanning certain folders, adding exclusions can significantly reduce resource usage.
Open Windows Security.
Select Virus & threat protection.
Click Manage settings.
Scroll to Exclusions.
Click Add or remove exclusions.
Choose:
- Folder
- File
- Process
- File type
Select the folder you want Defender to ignore.
Only exclude folders you completely trust.
Method 8: Stop Microsoft Defender Services
Some users attempt to stop Microsoft Defender services through the Services console.
Press Windows + R.
Type:
services.msc
Press Enter.
Locate services related to Microsoft Defender.
In current versions of Windows 11, these services are protected and usually cannot be permanently stopped through Services.
If the Stop option is unavailable, this behavior is normal.
Method 9: Boot into Safe Mode
If you need to troubleshoot Antimalware Service Executable, Safe Mode loads Windows with minimal services.
Open Settings.
Go to System > Recovery.
Click Restart now beside Advanced startup.
Choose:
- Troubleshoot
- Advanced options
- Startup Settings
- Restart
Press 4 or F4.
Windows starts in Safe Mode where Defender activity is greatly reduced.
This is useful for troubleshooting rather than permanent disabling.
Method 10: Use Microsoft Defender in Passive Mode
Organizations often configure Microsoft Defender to run in Passive Mode when another enterprise antivirus solution is installed.
Passive Mode allows Defender to remain installed while reducing active scanning.
This option is generally managed through enterprise policies and is not commonly available on standard home installations.
Why Antimalware Service Executable Uses High CPU
High resource usage is usually temporary.
Common causes include:
- Full system scans
- Windows Update
- Virus definition updates
- Large file downloads
- Extracting compressed archives
- Installing software
- External storage scanning
- Background maintenance
In most cases, CPU usage returns to normal after the scan completes.
Safer Alternatives to Disabling Defender
Instead of disabling Microsoft Defender completely, consider these safer options:
- Schedule scans during idle hours.
- Add trusted exclusions.
- Close unnecessary background applications.
- Keep Windows updated.
- Install another antivirus if preferred.
- Allow scans to finish before restarting the PC.
These options maintain security while improving performance.
Is It Safe to Disable Antimalware Service Executable?
It depends on your situation.
If another reputable antivirus program is installed, Windows usually manages the transition automatically.
If Microsoft Defender is your only antivirus, disabling it significantly increases the risk of malware infections, ransomware attacks, phishing threats, and malicious downloads.
For most home users, leaving Defender enabled is the safest choice.
Frequently Asked Questions
Can I permanently disable Antimalware Service Executable?
In recent versions of Windows 11, permanently disabling Microsoft Defender is much more difficult because Microsoft protects it with Tamper Protection and other security mechanisms.
Why does Antimalware Service Executable keep turning back on?
Windows automatically restores Microsoft Defender after updates, restarts, or if no other antivirus software is installed.
Does installing another antivirus disable Defender?
Yes. In most cases, Windows automatically reduces or disables Microsoft Defender’s real-time protection when it detects a compatible third-party antivirus.
Is Antimalware Service Executable a virus?
No. MsMpEng.exe is a legitimate Microsoft process that is part of Windows Security.
Conclusion
Antimalware Service Executable is an essential component of Microsoft Defender Antivirus, providing real-time protection against malware and other online threats. Although it can occasionally consume noticeable CPU, memory, or disk resources, this behavior is often temporary and occurs during security scans or updates.
If you need to reduce its impact, start by disabling real-time protection temporarily, scheduling scans more efficiently, or adding trusted exclusions. Advanced users can explore Group Policy or Registry methods where applicable, while installing a trusted third-party antivirus is the safest way to reduce Defender’s activity without sacrificing protection. Before disabling Microsoft Defender completely, carefully consider the security risks, as keeping reliable antivirus protection enabled is one of the most important steps in maintaining a secure Windows 11 system.
