Account Security Problems

Normal CPU and Memory Usage for Microsoft Defender Services

Steve K Sep 30, 2026 869 views

Question details

The user wants to understand the baseline CPU and memory resource usage for Microsoft Defender Antivirus and Defender for Endpoint on servers to identify when consumption becomes abnormal.

Normal CPU and Memory Usage for Microsoft Defender Services

Product: Microsoft Defender
Device & OS: not provided
Scenario: Monitoring server performance and evaluating Microsoft Defender's background resource consumption.
Observed behavior: Users need to know that background CPU usage is typically in the single digits, and need guidelines for identifying sustained high CPU (30-50%) or continuous memory increases.

Before you start

Ensure you have administrator access to the server and open the Task Manager or Resource Monitor to observe the current system performance.

Solution 1Recommended

Monitor and Evaluate Defender Resource Usage

Determine if your Microsoft Defender CPU and memory usage falls within normal operational ranges or requires further troubleshooting.

Microsoft Defender resource usage varies depending on server workload, configuration, scanning activity, and the presence of security threats. Background CPU usage is typically very low, often residing in the single digits or low double digits.

Open Task Manager

Right-click on the Windows taskbar and select 'Task Manager', or press Ctrl + Shift + Esc to open the system performance monitor.

Locate Defender Services

In the 'Processes' or 'Details' tab, look for 'Antimalware Service Executable' (MsMpEng.exe) or 'Microsoft Defender Core Service'.

Check CPU Usage Baselines

Observe the CPU column. It is normal for usage to spike during active scans, but sustained background CPU usage around 30-50% outside of scheduled scans is abnormal.

Monitor Memory Trends

Observe the Memory column over a period of time. Normal memory usage should stabilize. If memory usage continuously increases without dropping, it may warrant further investigation.

Review Official Documentation

If you observe sustained high usage, review the Microsoft Defender Core service documentation to collect performance data over time and identify potential conflicts.

Monitor and Evaluate Defender Resource Usage

Performance Variables: Keep in mind that there is no universal abnormality threshold, as heavy server workloads and complex directory structures will naturally cause Defender to consume more resources while scanning.

Free Microsoft Office alternative

Experience a Lightweight Office Suite with WPS Office

If you are monitoring system resources and want to ensure your daily productivity applications do not bog down your server or PC, consider WPS Office. It is a lightweight, highly compatible alternative to Microsoft Office that is designed to minimize CPU and memory footprints.

1. Download WPS Office: Visit the official WPS website and click the free download button.
2. Install the Application: Run the lightweight installer and follow the on-screen prompts to complete the setup in minutes.
3. Open and Edit Files: Launch WPS Office to immediately open your existing Word, Excel, or PowerPoint files with zero compatibility issues.

Extremely lightweight design with minimal background CPU and memory usage.Fully compatible with all Microsoft Office formats, including Word, Excel, and PowerPoint.Familiar user interface for seamless and effortless migration.All-in-one suite to manage your documents without stressing system resources.

microsoft office alternative - wps office

Frequently Asked Questions

Why is Microsoft Defender using so much CPU suddenly?

Sudden spikes in CPU usage usually occur during scheduled malware scans, signature updates, or when Defender is actively scanning a large batch of newly modified files. If the CPU usage remains above 30-50% for extended periods without an active scan, it should be investigated.

How can I reduce Microsoft Defender memory usage on a server?

To optimize resource usage, ensure you are running the latest version of Defender. You can also configure scanning exclusions for safe, high-traffic directories and schedule heavy, full-system scans during off-peak hours.

Is it normal for Antimalware Service Executable to run continuously?

Yes, the Antimalware Service Executable (MsMpEng.exe) must run continuously in the background to provide real-time protection against threats. However, its background resource consumption should normally remain low.

Microsoft Office Security Issues