How to Disable Antimalware Service Executable in Windows 11

The Antimalware Service Executable is a Windows process associated with Microsoft Defender Antivirus. You may see it in Task Manager as Antimalware Service Executable or MsMpEng.exe. It runs in the background to scan files, applications, downloads, and other parts of your computer for malware.

Sometimes, this process can use noticeable CPU, memory, or disk resources, especially while Windows Defender is performing a scan. This can make a PC feel slow, particularly on systems with limited hardware. However, completely disabling Microsoft Defender is not recommended for everyday use because it removes an important layer of protection.

Windows 11 also prevents some permanent Defender changes through features such as Tamper Protection. Instead of permanently turning off Antimalware Service Executable, you can temporarily disable real-time protection, configure trusted exclusions, or troubleshoot unusually high resource usage. The following methods show the available options.

Method 1: Temporarily Turn Off Real-Time Protection

The easiest way to stop Antimalware Service Executable from actively scanning files is to temporarily turn off Microsoft Defender’s real-time protection.

This is useful when you need to install trusted software, troubleshoot a compatibility problem, or determine whether Defender is responsible for unusually high CPU or disk usage.

1. Press Windows + I to open Settings.
2. Select Privacy & security from the left sidebar.
3. Click Windows Security.
4. Select Virus & threat protection.
5. Under Virus & threat protection settings, click Manage settings.
6. Find Real-time protection.
7. Turn the switch Off.
8. If Windows asks for permission through User Account Control, select Yes.

Microsoft Defender will stop real-time scanning while the setting remains disabled.

However, this is generally temporary. Windows can automatically turn real-time protection back on later, particularly after a period of time or following a restart.

When you finish the task that required Defender to be disabled, return to the same location and turn Real-time protection back on.

Method 2: Turn Off Real-Time Monitoring Using PowerShell

Windows 11 also provides PowerShell commands for changing certain Microsoft Defender settings.

This method can be useful when the graphical Windows Security interface is inconvenient.

1. Open the Start menu.
2. Search for PowerShell.
3. Right-click Windows PowerShell or PowerShell.
4. Select Run as administrator.
5. If User Account Control appears, select Yes.
6. Enter the following command:

Set-MpPreference -DisableRealtimeMonitoring $true

7. Press Enter.

This disables Defender’s real-time monitoring if Windows allows the setting to be changed.

To turn real-time monitoring back on, open an elevated PowerShell window and run:

Set-MpPreference -DisableRealtimeMonitoring $false

Keep in mind that Microsoft Defender can override or restrict this type of change when security protections such as Tamper Protection are enabled. Windows 11 is designed to prevent applications and users from silently weakening antivirus protection.

Therefore, this should be considered a temporary troubleshooting method rather than a way to permanently disable Microsoft Defender.

Method 3: Turn Off Tamper Protection Before Changing Defender Settings

Tamper Protection is designed to prevent unauthorized applications or users from changing important Microsoft Defender settings.

If you are trying to troubleshoot Defender behavior and Windows immediately restores a setting, Tamper Protection may be responsible.

You can check its status through Windows Security.

1. Open Settings.
2. Go to Privacy & security.
3. Select Windows Security.
4. Click Virus & threat protection.
5. Select Manage settings under Virus & threat protection settings.
6. Locate Tamper Protection.
7. Check whether it is enabled.

For legitimate troubleshooting, you can temporarily turn it off and make the required change.

After completing your troubleshooting, return to the same screen and turn Tamper Protection back on.

Leaving Tamper Protection disabled is not recommended because it makes it easier for unwanted software to modify Microsoft Defender’s security configuration.

If your objective is simply to reduce CPU usage from Antimalware Service Executable, disabling Tamper Protection is usually unnecessary. Try the less disruptive methods below first.

Method 4: Add an Exclusion for a Trusted Folder

If Defender constantly scans a particular folder and causes high disk or CPU usage, you may not need to disable the entire antivirus.

Instead, you can add an exclusion for a specific folder that you completely trust.

1. Open Windows Security.
2. Select Virus & threat protection.
3. Click Manage settings.
4. Scroll down to Exclusions.
5. Select Add or remove exclusions.
6. Click Add an exclusion.
7. Choose Folder.
8. Select the folder you want to exclude.

Microsoft Defender will no longer perform the same real-time scanning on the excluded location.

This approach can be useful for development folders, large trusted projects, virtual machine directories, or other locations that generate frequent file activity.

Only exclude folders that you trust. If malicious software is later placed inside an excluded folder, Microsoft Defender may not detect it in the normal way.

Avoid excluding your entire system drive or large parts of your computer simply to reduce resource usage.

Method 5: Exclude a Trusted File or Application

Windows Security also allows you to exclude individual files.

This can be more targeted than disabling Defender completely.

1. Open Windows Security.
2. Select Virus & threat protection.
3. Click Manage settings.
4. Scroll to Exclusions.
5. Click Add or remove exclusions.
6. Select Add an exclusion.
7. Choose File.
8. Select the trusted executable or file.

This can help when a particular application repeatedly triggers scanning activity.

For example, a trusted application that creates thousands of temporary files may cause Defender to inspect those files repeatedly. An appropriate exclusion can reduce this activity without turning off protection for the rest of the computer.

Do not use exclusions simply because a file has been detected as suspicious. If Windows Security identifies malware, investigate the detection before deciding whether the file should be trusted.

Method 6: Check Whether Defender Is Actually Causing High Usage

Before disabling Antimalware Service Executable, check whether it is really responsible for your computer’s slowdown.

1. Press Ctrl + Shift + Esc to open Task Manager.
2. Stay on the Processes tab.
3. Look for Antimalware Service Executable.
4. Check its CPU, Memory, and Disk usage.
5. Observe the process for several minutes.

Defender may temporarily use more resources while performing a scan. High usage that disappears after the scan finishes may not indicate a problem.

If the process continues using a large amount of resources for a long time, check whether Windows Update, application installation, or another background activity is occurring at the same time.

You can also open Windows Security and check Virus & threat protection to see whether a scan is currently running.

Stopping the process directly from Task Manager is generally not an effective solution. Windows Defender is a protected security component, and Windows may restart it automatically.

Method 7: Update Windows and Microsoft Defender

Sometimes unusually high Defender activity can be related to outdated Windows components or security intelligence.

Updating Windows can therefore be a better solution than disabling the antivirus.

To check for Windows updates:

1. Press Windows + I.
2. Select Windows Update.
3. Click Check for updates.
4. Install available updates.
5. Restart the computer if required.

You can also update Microsoft Defender’s security intelligence through Windows Security.

1. Open Windows Security.
2. Select Virus & threat protection.
3. Find Virus & threat protection updates.
4. Click Protection updates.
5. Select Check for updates.

After updating, restart your computer and check Task Manager again.

If the high resource usage was caused by an outdated component or a temporary Windows problem, updating the system may resolve it without requiring Defender to be disabled.

Method 8: Repair Windows System Files

If Antimalware Service Executable continues consuming unusually high resources and other Windows security components are also behaving incorrectly, damaged system files may be contributing to the problem.

Windows includes built-in tools called System File Checker and Deployment Image Servicing and Management.

First, open Windows Terminal or Command Prompt as administrator.

1. Open Start.
2. Search for Terminal.
3. Right-click it.
4. Select Run as administrator.
5. Run:

DISM /Online /Cleanup-Image /RestoreHealth

6. Wait for the process to finish.
7. Then run:

sfc /scannow

8. Allow the scan to complete.
9. Restart Windows.

These commands check and repair Windows system components. They do not disable Microsoft Defender.

If Defender continues consuming excessive resources after Windows has been updated and system files have been repaired, the issue may require further troubleshooting rather than simply disabling the antivirus.

Should You Permanently Disable Antimalware Service Executable?

Antimalware Service Executable is not an independent application that you normally uninstall. It is part of Microsoft Defender Antivirus.

For that reason, permanently disabling it is different from closing an ordinary background program.

Windows 11 includes security mechanisms intended to prevent Defender from being permanently disabled casually. In addition, turning off antivirus protection leaves the computer more exposed to malicious software.

If your goal is to solve high CPU or disk usage, first determine why Defender is active. A scan in progress, frequent file changes, outdated definitions, or a particular application can all increase its activity.

For most users, an exclusion for a specific trusted location or application is a more targeted approach than disabling the entire antivirus.

If you only need Defender turned off temporarily for a specific task, use Windows Security’s Real-time protection setting and turn it back on afterward.

Conclusion

Antimalware Service Executable, shown as MsMpEng.exe, is an important part of Microsoft Defender Antivirus in Windows 11. You may notice it using CPU, memory, or disk resources when Defender scans your computer, but simply ending the process from Task Manager is not a reliable way to disable it.

Windows 11 provides several ways to temporarily stop real-time protection or reduce Defender’s scanning activity. You can use Windows Security to temporarily disable real-time protection, use PowerShell for supported configuration changes, or adjust Tamper Protection during legitimate troubleshooting. For performance problems, adding a carefully selected exclusion can be a better option than disabling antivirus protection entirely.

If Antimalware Service Executable is constantly consuming high resources, investigate the underlying cause before disabling security features. Updating Windows and Defender, checking active scans, and repairing system files can sometimes solve the problem without reducing your computer’s protection.

FAQs

1. What is Antimalware Service Executable in Windows 11?

Antimalware Service Executable is the Windows process associated with Microsoft Defender Antivirus. Its executable is commonly shown as MsMpEng.exe in Task Manager.

2. Can I permanently disable Antimalware Service Executable?

Windows 11 is designed to prevent casual permanent disabling of Microsoft Defender. Settings such as Tamper Protection can also restrict changes. Permanently disabling antivirus protection is not recommended for normal everyday use.

3. Why is Antimalware Service Executable using so much CPU?

It may be performing a malware scan or inspecting recently changed files. High usage can also occur when applications generate large numbers of files. If usage remains unusually high for a long period, update Windows and Defender and investigate the underlying cause.

4. Is it safe to stop MsMpEng.exe from Task Manager?

It is not a reliable method for disabling Microsoft Defender. Windows can restart the process automatically, and interfering with antivirus protection can reduce your computer’s security.

Quick Summary

• Antimalware Service Executable (MsMpEng.exe) is part of Microsoft Defender Antivirus.
• Use Windows Security > Virus & threat protection to temporarily turn off real-time protection when necessary.
• For high resource usage, consider a carefully selected exclusion instead of disabling Defender completely.
• If the process remains unusually active, update Windows and Defender and repair system files before attempting more aggressive changes.