MsMpEng.exe high CPU usage on Windows Server 2012

Question

We have a Windows Server 2012 installation that we use as an internal web server. Most HTTP requests are very slow on this machine (about 15 seconds for a simple ASP.NET WebAPI request). We noticed that during a request, the process MsMpEng.exe's CPU usage is going to 50-90%.

MsMpEng.exe is Microsoft's Anti-Malware executable, included in Windows Defender, Forefront and Security Essentials. However, none of those products is installed on our server.

Where can we configure the Anti-Malware component of Windows Server 2012?

Nope, there isn't any Defender entry there.. If I enter `Defender` and press `Enter`, Windows Search shows `No results found for your search` — Jonas Sourlier, Jul 08 '14 at 10:43

score 8 · Accepted Answer · edited Aug 25 '21 at 19:29

8

We analyzed the problem with Sysinternals ProcessMonitor, where we saw that MsMpEng.exe consumes much CPU time analyzing the log files of our web application (written by NLog).

Since we could not find a GUI to exclude the log files from MsMpEng.exe's real-time monitoring, we added it using regedit.exe.

The solution was to create a DWORD entry at

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths`

where the key of the entry is set to the full path of our log files (C:\inetpub\wwwroot\webapp\logs), and leaving the DWORD value at 0x00000000.

edited Aug 25 '21 at 19:29

рüффп

620
1
11
25

answered Jul 08 '14 at 10:48

Jonas Sourlier

293
1
3
9

This is an old answer and we already got UI for this: Start menu --> Virus & thread protection --> Manage settings -> Add or remote exclusions. Also it is possible to provide exclusions with policy editor. – Roman R. Apr 24 '21 at 10:09
Nice answer, and I forgot about the powerful Sysinternals tools. I edited your answer to add the official link. – рüффп Aug 25 '21 at 06:40
@RomanR. I can't find Start menu --> Virus & thread protection --> Manage settings -> Add or remote exclusions on my windows 2012. Are you sure? – mortenma71 Nov 18 '21 at 22:50
How did you manage to find which files "MsMpEng.exe" is trying to scan? I'd like to make exclusions as well :( – platypus Aug 12 '22 at 10:04

Jim Wolff · Answer 2 · 2018-08-01T09:05:53.333

3

You might find it under Endpoint Protection or System Center Endpoint Protection, there you can set excluded filetypes and such under settings.

edited Aug 01 '18 at 09:05

answered Nov 05 '16 at 19:30

Jim Wolff

161
4

MsMpEng.exe high CPU usage on Windows Server 2012

2 Answers2