{"id":70989,"date":"2024-01-26T11:20:04","date_gmt":"2024-01-26T05:50:04","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=70989"},"modified":"2026-03-09T12:19:01","modified_gmt":"2026-03-09T06:49:01","slug":"defender-100-cpu-usage-full-scan","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/defender-100-cpu-usage-full-scan\/","title":{"rendered":"[Fix] Windows Defender 100% CPU Usage During Full Scan"},"content":{"rendered":"

When you run a full scan using Microsoft Defender Antivirus, about 30 seconds to 1 minute into the scan, the CPU usage spikes and uses up all the remaining CPU. Its CPU usage remains at 100% throughout the full scan. The CPU fan becomes loud. Due to this issue, systems with heating issues may abruptly shut down during a full scan.<\/p>\n

\"defender
Antimalware Service Executable – High CPU usage during full scan<\/figcaption><\/figure>\n

Many users are worried about the continuous high CPU usage by MsMpEng.exe during a full scan and that it might have a detrimental effect on the computer hardware, especially on systems with a massive number of files.<\/p>\n

You may have used the local group policy editor to set “Specify the maximum percentage of CPU utilization during a scan” (or the equivalent “AvgCPULoadFactor<\/strong>” registry setting) to throttle the CPU usage for scans. But that may not have helped.<\/p>\n

Cause<\/h2>\n

By default, Microsoft Defender uses 100% CPU during full scans, and usage remains at 100% till the scan is complete. The CPU throttling is applied only for scheduled\/idle scans.<\/p>\n

\"Windows
Windows Defender CPU usage during full scan – CPU throttle Off<\/figcaption><\/figure>\n

(Open the image in a new window to see the full-size image.)<\/em><\/p>\n

Even though the “ScanAvgCPULoadFactor” metric is set to 50% by default, it’s applied only during scheduled scans.<\/p>\n

However, there is also a way to enable CPU throttling during manual scans.<\/p>\n

Resolution<\/h2>\n

To throttle the CPU usage during a full scan using Defender, launch PowerShell (admin).<\/p>\n

Run the following commands:<\/p>\n

set-mppreference -ThrottleForScheduledScanOnly $false\n\nset-mppreference -DisableCpuThrottleOnIdleScans $false\n\nset-mppreference -ScanAvgCPULoadFactor 50<\/pre>\n
(The commands #2 and #3 may not be required on most systems. But it doesn’t hurt to run them anyway.)<\/em><\/p>\n
\"CPU<\/p>\n
Reference: <\/em>Set-MpPreference (Defender) | Microsoft Learn<\/em><\/a><\/p>\n
From now on, CPU throttling will apply to scheduled and manual scans.<\/h4>\n
Close Windows Security and relaunch it. Run a full scan.<\/p>\n
Now, look at the CPU usage during a full scan.<\/p>\n
\"Windows
Windows Defender CPU usage during full scan – CPU throttle enabled<\/figcaption><\/figure>\n
(Open the image in a new window to see the full-size image.)<\/em><\/p>\n
As you can see in the above screenshot, the CPU usage touches 100% occasionally but never stays at 100%. It’s a huge improvement.<\/p>\n
Editor’s note<\/h3>\n
A full scan is usually not needed unless you want to remove inactive malware-dropped files that may be lurking in the hard disk in the aftermath of a malware attack. Quick scan, real-time protection, and tamper protection features should be sufficient on most systems.<\/p>\n","protected":false},"excerpt":{"rendered":"
When you run a full scan using Microsoft Defender Antivirus, about 30 seconds to 1 minute into the scan, the CPU usage spikes and uses up all the remaining CPU. Its CPU usage remains at 100% throughout the full scan. The CPU fan becomes loud. Due to this issue, systems with heating issues may abruptly … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[8,869],"tags":[396,661,958],"class_list":["post-70989","post","type-post","status-publish","format-standard","hentry","category-windows-10","category-windows-11","tag-powershell","tag-windows-defender","tag-windows-security"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":18635,"url":"https:\/\/www.winhelponline.com\/blog\/pc-doctor-module-high-cpu-memory-and-disk-usage-and-slowdown\/","url_meta":{"origin":70989,"position":0},"title":"“PC-Doctor Module” High CPU, Memory, Disk Usage and Slowdown","author":"Ramesh","date":"September 16, 2020","format":false,"excerpt":"Occasionally, your system may slow down to a crawl due to the PC-Doctor Module process that runs in the background. When this happens, it can take several seconds to open the Task Manager or any program. The Task Manager may show that a process named PC-Doctor Module is occupying 100%\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"dell pc-doctor module 100% cpu and memory usage","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/09\/dell-pc-doctor-high-cpu-7.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":75552,"url":"https:\/\/www.winhelponline.com\/blog\/fake-com-surrogate-high-cpu\/","url_meta":{"origin":70989,"position":1},"title":"Fix: Fake COM Surrogate and High CPU Usage","author":"Ramesh","date":"June 15, 2024","format":false,"excerpt":"If Task Manager shows COM Surrogate occupying high CPU or memory usage, it's most likely a miner. It's a fake COM Surrogate process whose name might be DlIHost.exe (DLIHOST.EXE) instead of DllHost.exe. The fake COM Surrogate process (DLIHOST.exe) may be located in the folder \"C:\\Users\\%username%\\AppData\\Roaming\\Dll\". It runs runs as a\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"COM Surrogate high CPU usage","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/06\/COM-Surrogate.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/06\/COM-Surrogate.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/06\/COM-Surrogate.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/06\/COM-Surrogate.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":59512,"url":"https:\/\/www.winhelponline.com\/blog\/common-language-runtime-native-compiler-100-cpu\/","url_meta":{"origin":70989,"position":2},"title":"Microsoft Common Language Runtime Native Compiler 100% CPU Usage","author":"Ramesh","date":"July 18, 2023","format":false,"excerpt":"When you open Task Manager, you may see that the module \"Microsoft common language runtime native compiler\" may use 100% of the CPU and hamper the device's performance. If the task is ended manually, it starts up automatically after about 10-20 minutes. You may wonder what causes this issue and\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":19416,"url":"https:\/\/www.winhelponline.com\/blog\/software-protection-platform-service-sppsvc-high-cpu-usage\/","url_meta":{"origin":70989,"position":3},"title":"[Fix] Microsoft Software Protection Platform (sppsvc) High CPU Usage","author":"Ramesh","date":"October 20, 2020","format":false,"excerpt":"Your system may slow down to a crawl, and when you open Task Manager, you may find the Microsoft Software Protection Platform Service (sppsvc) utilizing very high CPU (ranging anywhere from 30% to 75%) for a considerably long time. You may be wondering why the Software Protection service is consuming\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"microsoft software protection service sppsvc high cpu usage","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/sppsvc-suspend-resmon.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/sppsvc-suspend-resmon.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/sppsvc-suspend-resmon.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/sppsvc-suspend-resmon.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":75787,"url":"https:\/\/www.winhelponline.com\/blog\/wmi-high-cpu-and-memory\/","url_meta":{"origin":70989,"position":4},"title":"Fix: WMI consuming High CPU and Memory","author":"Ramesh","date":"July 2, 2024","format":false,"excerpt":"When you open Task Manager to investigate a sluggish computer, you may see that the WMI Provider Host (WmiPrvSE.exe) process uses a lot of CPU and memory. Here's a screenshot from another computer where the Windows Management Instrumentation service (Winmgmt) occupies more CPU usage on some systems than on a\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"ASUS lightingservice.exe high cpu usage","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/07\/lighting-service-high-cpu.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/07\/lighting-service-high-cpu.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/07\/lighting-service-high-cpu.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/07\/lighting-service-high-cpu.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":5488,"url":"https:\/\/www.winhelponline.com\/blog\/xdgaudio-vbs-80070002-malware\/","url_meta":{"origin":70989,"position":5},"title":"Error 80070002 xdgaudio.vbs cannot find the file specified?","author":"Ramesh","date":"October 12, 2017","format":false,"excerpt":"If you're receiving the following error message related to \"xdgaudio.vbs\" in your system, then your computer is most likely infected. Script:\u00a0\u00a0\u00a0 C:\\windows\\xdgaudio.vbs Line:\u00a0\u00a0\u00a0 3 Char:\u00a0\u00a0\u00a0 1 Error:\u00a0\u00a0\u00a0 The system cannot find the file specified. Code:\u00a0\u00a0\u00a0 80070002 Source:\u00a0\u00a0\u00a0\u00a0 (null) When edited with Notepad, the script may contain lines such as below:\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"xdgaudio.vbs error malware","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/xdgaudio-error-1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/xdgaudio-error-1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/xdgaudio-error-1.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/70989","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=70989"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/70989\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=70989"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=70989"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=70989"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}