How to Disable Antimalware Service Executable in Windows 2026

Antimalware Service Executable is a Windows process. Its file name is MsMpEng.exe. It runs as part of Windows Defender, which is Microsoft’s built-in antivirus program.

You will find it in Task Manager under that exact name. It handles real-time protection, scanning files as you open them, and running scheduled full scans in the background.

The problem most people face: it eats CPU and RAM. Sometimes it spikes to 50% or even 90% CPU usage. Your PC slows down, fans spin loudly, and work gets interrupted. That is why you are here.

This article shows you exactly how to disable or limit Antimalware Service Executable on Windows 10 and Windows 11.

Should You Actually Disable It?

Before you do anything, understand the trade-off.

Disabling Windows Defender means your PC has no real-time antivirus protection unless you install a third-party alternative. If you already use software like Malwarebytes Premium, Bitdefender, or Norton, Windows will automatically turn off Defender anyway. You do not need to do anything manually in that case.

If you have no other antivirus, do not permanently disable this process. You can limit it instead of killing it completely. That is the smarter move.

Quick rule:

• Have a third-party antivirus? Disable Defender fully.
• No other antivirus? Limit the process instead of disabling it.

Method 1: Disable Windows Defender Through Windows Security Settings

This is the simplest method. It works on Windows 10 and Windows 11.

Steps:

1. Press the Windows key and type Windows Security
2. Click Virus and threat protection
3. Scroll down to Virus and threat protection settings
4. Click Manage settings
5. Toggle Real-time protection to Off
6. Confirm when Windows asks for permission

This stops Antimalware Service Executable from scanning files in real time. The process may still run occasionally, but CPU usage drops significantly.

Note: Windows will turn this back on automatically after a restart or after a few hours. This is by design. To make it permanent, use Method 2 or Method 3 below.

Method 2: Disable Antimalware Service Executable Using Group Policy

Group Policy gives you permanent control. This method works on Windows 10 Pro, Windows 11 Pro, and Enterprise editions. It does not work on Home editions.

Steps:

1. Press Windows + R to open the Run box
2. Type gpedit.msc and press Enter
3. In the left panel, navigate to: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus
4. In the right panel, double-click Turn off Microsoft Defender Antivirus
5. Select Enabled
6. Click Apply, then OK
7. Restart your computer

After restart, Antimalware Service Executable will no longer run. Windows Defender is off.

To reverse this: Go back to the same setting and switch it to Not Configured.

Method 3: Disable It Through the Registry Editor

This method works on Windows Home editions where Group Policy is not available. Be careful editing the registry. A wrong change can cause system issues. Follow each step exactly.

Steps:

1. Press Windows + R, type regedit, press Enter
2. Allow the prompt if it appears
3. In the address bar at the top, paste this path and press Enter: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
4. Right-click on Windows Defender in the left panel
5. Select New > DWORD (32-bit) Value
6. Name it DisableAntiSpyware
7. Double-click it and set the value to 1
8. Click OK
9. Restart your computer

The process will no longer start automatically.

To reverse this: Go back, double-click the same value, and change it to 0. Or delete the entry entirely.

Method 4: Exclude Folders to Reduce CPU Usage (Without Disabling)

If you do not want to turn off Defender completely, you can reduce how hard Antimalware Service Executable works by adding exclusions. This is useful if the process spikes when you open certain apps or folders.

Steps:

1. Open Windows Security
2. Go to Virus and threat protection
3. Click Manage settings
4. Scroll to Exclusions
5. Click Add or remove exclusions
6. Click Add an exclusion
7. Choose Folder and select the folder you want to exclude (for example, your game folder or development workspace)

This tells Defender to stop scanning that folder in real time. CPU usage in those areas drops noticeably.

Method 5: Limit CPU Usage via Task Scheduler

This method does not disable the process but stops it from running full scans at bad times.

Antimalware Service Executable runs scheduled scans in the background. These scans are what cause major CPU spikes. You can reschedule or limit them.

Steps:

1. Press Windows key and search Task Scheduler
2. Open it
3. In the left panel, go to: Task Scheduler Library > Microsoft > Windows > Windows Defender
4. You will see several tasks listed on the right
5. Right-click Windows Defender Scheduled Scan
6. Click Properties
7. Go to the Conditions tab
8. Check Start the task only if the computer is idle for and set a time (like 10 minutes)
9. Also check Stop if the computer ceases to be idle
10. Click OK

Now scans only run when you are not actively using the PC. This is one of the best middle-ground solutions.

You can also disable the scheduled scan entirely by right-clicking it and selecting Disable.

Method 6: Disable Defender Using PowerShell

For users comfortable with command lines, PowerShell gives a fast, clean way to turn off Windows Defender.

Steps:

1. Right-click the Start button
2. Click Windows Terminal (Admin) or PowerShell (Admin)
3. Type this command and press Enter:

Set-MpPreference -DisableRealtimeMonitoring $true

This disables real-time monitoring. To turn it back on:

Set-MpPreference -DisableRealtimeMonitoring $false

To disable Defender completely via PowerShell:

Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableIOAVProtection $true

This is a quick toggle and works well if you need to disable it temporarily for a task.

All Methods at a Glance

Method	Works on Home?	Permanent?	Difficulty	Best For
Windows Security Toggle	Yes	No (resets)	Easy	Quick temporary fix
Group Policy Editor	No (Pro/Enterprise only)	Yes	Medium	Pro/Enterprise users
Registry Editor	Yes	Yes	Medium	Home edition users
Folder Exclusions	Yes	Yes	Easy	Reducing CPU, not disabling
Task Scheduler	Yes	Yes	Medium	Controlling scan timing
PowerShell	Yes	No (until restart)	Easy	Fast, temporary toggle

Why Does Antimalware Service Executable Use So Much CPU?

Understanding why helps you fix it smarter.

There are three main reasons it spikes:

1. It is scanning itself. By default, Windows Defender does not exclude its own folder from scanning. It scans MsMpEng.exe while it is running. This creates a loop that burns CPU. Fixing this: add C:\Program Files\Windows Defender to the exclusions list.

2. Scheduled scans overlap with your work. Full scans run in the background on a schedule. If that schedule overlaps with when you use your PC heavily, you will feel it. Fix: reschedule or disable scheduled scans in Task Scheduler.

3. Real-time protection on large folders. If you work with thousands of files (code repos, game assets, media libraries), real-time scanning of every file access is slow. Fix: exclude those folders.

What Happens After You Disable It?

When Antimalware Service Executable is disabled, Windows will show a notification in your taskbar saying your device is at risk. This is expected behavior. You can dismiss it.

If you have a third-party antivirus running, it will register itself with Windows Security Center and that warning will go away on its own.

Your PC will not automatically reactivate Defender if you used the Group Policy or Registry method. The Windows Security toggle method, however, will reset after some time.

Third-Party Antivirus and Defender Together

Running two antivirus programs at the same time is bad practice. They conflict with each other, scan the same files twice, and slow your system down even more.

When you install a reputable third-party antivirus, Windows automatically disables Defender in most cases. You can verify this by opening Windows Security and checking if it says another antivirus is managing your protection.

If Defender is still running alongside your third-party antivirus, use Method 2 or Method 3 to turn it off permanently.

According to AV-TEST, independent antivirus testing labs regularly score programs like Bitdefender, Kaspersky, and Norton higher than Windows Defender on detection rates. If you want better protection, switching is a reasonable choice.

How to Confirm Antimalware Service Executable Is Disabled

After applying any method, verify it worked.

1. Press Ctrl + Shift + Esc to open Task Manager
2. Click the Details tab
3. Look for MsMpEng.exe

If it is not listed, Defender is off. If it still shows but with 0% CPU usage, it may still be present but idle, which is acceptable if you do not want real-time scanning.

You can also check via PowerShell:

Get-MpComputerStatus

Look for RealTimeProtectionEnabled. If it says False, real-time protection is off.

Conclusion

Antimalware Service Executable causes high CPU usage because it is doing its job, just not always at the right time or in the right way. The good news is you have multiple ways to deal with it in 2026.

The fastest fix is to disable real-time protection from Windows Security settings, but it is not permanent. For a lasting solution, use Group Policy if you are on Windows Pro, or edit the Registry if you are on Windows Home. If you want to keep some protection, just add exclusions for the folders that matter most and reschedule scans to run when you are away from your PC.

Frequently Asked Questions

Is it safe to disable Antimalware Service Executable?

It is safe if you have another antivirus installed or if you are careful about what you download. Without any protection, your PC is vulnerable to malware. Only disable it permanently if you have a reliable replacement running.

Why does Antimalware Service Executable keep coming back after I turn it off?

Windows is designed to re-enable Defender when it detects no other antivirus is active. The simple toggle in Windows Security settings will reset on its own. Use the Group Policy or Registry method for a permanent change.

Can I delete MsMpEng.exe directly?

Do not delete MsMpEng.exe. It is a protected system file. Attempting to delete it can cause Windows errors. Use the proper methods above to disable the service instead.

Will disabling Antimalware Service Executable speed up my PC?

Yes, especially if the process was regularly spiking your CPU. Many users report significantly faster performance after disabling it or adding exclusions, particularly on older hardware or during heavy workloads.

Does Antimalware Service Executable run on Windows 11 the same way as Windows 10?

Yes. The process runs the same way on both Windows 10 and Windows 11. All the methods in this article apply to both versions. The interface locations may look slightly different but the steps are the same.