High CPU and Disk I/O primarily caused by MsMpEng.exe?

Is anyone having intermittent high cpu temp at idle?
I’m running latest bios 0.21. thanks.
Haven’t had time to look into it properly just putting it here as a placer until i get more time.

I suppose most users would probably not notice because the fan is loud all the time generally so you would be unaware of a cpu spiking high unless using HWMonitor / HWiNFO or Resource Monitor?

Obviously it would be noticeable playing a game as when mine is spiking out i can struggle to close resource monitor so gaming wouldn’t be doing too good.

Only for comparison: bios 0.19 - constant 47-49 degrees at idle while charging.

using Windows Resource Monitor I can see that the bulk of the cpu sometimes spiking cpu to go above 100% is msmpeng.exe
and tiworker.exe

msmpeng.exe see here https://thewindowscentral.com/msmpeng-exe-high-cpu/

and tiworker.exe see here https://answers.microsoft.com/en-us/windows/forum/windows_10-performance/high-cpu-usage-caused-by-tiworkerexe/ae12110a-15ca-49cb-be24-c6200072b436

FYI - Using psensor (https://itsfoss.com/check-laptop-cpu-temperature-ubuntu/) in Ubuntu Mate 19.04 Live to check CPU temp at idle and its 46-47 degrees.

1 Like

Ok so further diagnostics after doing ALL windows updates and restarting and checking all was happy indicates that the issue is with MsMpEng.exe

I’m getting excessively high CPU and some Disk I/O issues and sudden increase in Memory Hard Faults/sec

see screenshot.

This is happening frequently but in bursts so I will experience spike in CPU and I/O and then will be maxed out for a 2-4 minutes then die off on its own. Then 15 minutes or so the same thing happens again.

I’ll try get a better screenshot as I managed to catch this. I’ve modified the Thread Title to reflect the issue.

Any advice would be appreciated.

It just happened again and as well as the above I see mscorescw.exe several times appear as status (terminated)

@petem MsMpEng.exe is part of Windows Defender (built-in antivirus). You could try disabling that and download a different A/V program. Otherwise, it might just be doing updates and running initial scans and might calm down after awhile.

Hmm. I never enabled it. I Just checked in “Windows Security” app and “Virus & threat protection” has a yellow exclamation mark and a button that says turn on.

I assume therefore that it’s not enabled?

EDIT: Rule 1 - Never assume. lol. I’m always quick to say this to others but seeminly dont take my own advice huh? lol
I can see that inside settings "Real time protection and Cloud Delivered Protection and Automatic sample submission are all ON.

I will disable thanks. @Bluegizmo83

@petem lol no problem, we’ve all done it :slight_smile:

I did also find this, if it still shows up after disabling Defender:

If Windows Defender is “off” should MsMpEng even be running?

Only and only if you have Microsoft Security Essentials or System Center Endpoint Protection installed.

Otherwise, no.

1 Like

To Disable Windows Security for All Users I used regedit to changed following Registry Keys

(Windows Defender Security Center Service)

(Security Center service)


2 = Enable
4 = Disable

I then restarted the machine.

see here:

Marking as resolved - pending re-test.

Nope. Still happening.
Any one have any suggestions?
I’ve checked and cannot see Microsoft Security Essentials installed or System Center Endpoint Protection

@petem might be worth checking the windows system services (Control Panel > Administrative Tools > Services) and scroll down to the Windows Defender items and make sure they’re Startup Type is set to Manual or Disabled.

1 Like

For some reason when I go in here I can see

  1. Windows Defender Antivirus Network Inspection Service
  2. Windows Defender Antivirus Service

Both will not allow me to stop them and when I double click and get properties Start / Stop / pause and resume are greyed out.

I tried in normal and running Control Panel>Administrator Tools>services in Administrator mode

I also tried in msconfig > services but seems it won’t disable

Any solution ?