Microsoft Defender for Endpoint High CPU Troubleshooting Guide
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
MDE's MsSense.exe sensor and MsMpEng.exe antimalware engine are frequent sources of CPU spikes on Windows endpoints, particularly in development, database, and manufacturing environments with active file I/O. This guide walks through identifying the offending process, scoping exclusions safely, tuning scan schedules, and repairing a looping sensor service. For related engine update issues, see the Microsoft Defender engine update force update guide.
Identifying MsSense.exe vs MsMpEng.exe as the CPU Source
Open Task Manager and sort by CPU. MsSense.exe is the Microsoft Defender for Endpoint sensor process responsible for behavioral telemetry collection. MsMpEng.exe is the Windows Defender antimalware engine responsible for real-time scanning. High MsSense.exe CPU usually indicates heavy file system activity that the sensor is tracking, such as source code compilation or large file operations. High MsMpEng.exe CPU usually indicates active scanning of files being written to disk. For a more detailed view, use Process Monitor from Sysinternals filtered to MsSense.exe or MsMpEng.exe to see which files or processes they are examining. This distinction matters because the fix differs: MsSense.exe CPU is reduced through Defender for Endpoint exclusions (not standard antimalware exclusions), while MsMpEng.exe responds to both exclusion path configuration and scan schedule tuning.
Configuring Antimalware Exclusions for Development and Database Workloads
Process-based exclusions are safer than folder exclusions because they limit the attack surface. In Intune, navigate to Endpoint security > Antivirus > Create policy > Windows > Microsoft Defender Antivirus. Under Excluded processes, add the specific compiler or database executable (msbuild.exe, sqlservr.exe, java.exe for specific workloads). Avoid adding broad paths like C:\Program Files or C:\Users as folder exclusions. For MDE-specific behavioral exclusions (MsSense.exe CPU), use the Endpoint Detection and Response (EDR) exclusion list in Microsoft Defender security portal > Settings > Endpoints > Advanced features > EDR in block mode exclusions. Test exclusions in audit mode before enforcing by reviewing alerts in the Defender security portal for 48 hours after the change.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Tuning Scan Schedules and Cloud-Delivered Protection Settings
Scheduled scans compound CPU issues when they overlap with peak business hours. In Intune > Endpoint security > Antivirus > the policy > Scan, set the scheduled scan day and time to outside business hours, typically Sunday at 2 AM. Set scan type to Quick Scan rather than Full Scan for the scheduled job; full scans cause sustained high CPU for 1 to 3 hours. Under cloud-delivered protection, switch from High or High+ protection levels to Default if your organization does not require the fastest zero-day response. High protection levels send more file samples to the cloud and trigger more in-process analysis. Verify the change in Intune policy compliance status before closing the incident. For immediate relief, you can pause real-time protection temporarily using the Defender admin console, but re-enable it within 2 hours.
Repairing the MDE Sense Service When It Loops or Crashes
If MsSense.exe consistently restarts and shows high CPU in short bursts, the sensor service may be in a crash loop. Run sc query sense in an elevated command prompt to check the service status. If it shows RUNNING but then fails within seconds, check the Windows Event Log under Applications and Services > Microsoft > Windows > SENSE > Operational. Error event 7 or 15 indicates a sensor connectivity or licensing issue. To repair the sensor, run mpcmdrun.exe -resetplatform in C:\Program Files\Windows Defender as administrator. If the loop persists, offboard the device using the Intune offboarding package, uninstall the MDE sensor via Add or Remove Programs (if visible), and re-onboard using the Intune onboarding package from the Defender security portal. This clears the sensor state database without affecting Windows Defender Antivirus configuration.
Resolving Conflicts Between MDE and Third-Party Security Tools
Running MDE alongside third-party EDR agents (CrowdStrike Falcon, Carbon Black, SentinelOne) causes kernel-level filter driver conflicts that manifest as high CPU in both agents. MDE supports passive mode for coexistence, where it retains telemetry collection but defers real-time protection to the third-party tool. Enable passive mode by setting the registry key HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\ForceDefenderPassiveMode to 1, or via Intune device configuration profile. In passive mode, MsSense.exe CPU drops significantly because real-time scanning is handled by the third-party agent. Verify passive mode is active by running sc query windefend; if the antimalware service shows STOPPED or PAUSED, passive mode is working correctly. Do not run two active EDR agents simultaneously on the same endpoint.
Validating CPU Impact After Changes with Windows Performance Monitor
After making exclusion or scan schedule changes, measure the impact before closing the ticket. Open perfmon.exe and add the % Processor Time counter filtered to the MsSense.exe and MsMpEng.exe instances. Capture a 15-minute baseline during peak business activity. CPU usage for MsSense.exe should be below 5% during normal operations and below 15% during active file I/O. MsMpEng.exe should stay below 10% outside of scheduled scan windows. If CPU remains elevated after exclusions, use Windows Performance Recorder (wpr.exe -start CPU -start FileIO) for 60 seconds during a spike, stop it, and open the .etl file in Windows Performance Analyzer to identify which file paths or processes are driving the scan load. Send the trace to Microsoft support if a hotfix is needed.
The bottom line
Scope antimalware exclusions by process and path, not by broad folder exclusion, to maintain protection while reducing CPU impact. After any exclusion change, run a manual quick scan and verify detection coverage using the EICAR test file. For persistent MsSense.exe CPU usage above 20% under idle conditions, open a Microsoft support case; sensor loop conditions require a hotfix rather than configuration changes.
Frequently asked questions
What is the difference between MsSense.exe and MsMpEng.exe causing high CPU in Microsoft Defender for Endpoint deployments?
MsSense.exe is the MDE behavioral telemetry sensor and responds to Endpoint Detection and Response exclusions. MsMpEng.exe is the antimalware engine and responds to antimalware exclusions and scan schedule tuning. Identify which process is causing the spike in Task Manager before applying a fix, as the remediation path differs for each.
How do I configure process-based antimalware exclusions in Intune to reduce MDE CPU usage without weakening security posture?
In Intune > Endpoint security > Antivirus > the policy, add specific executables (msbuild.exe, sqlservr.exe) under Excluded processes rather than adding broad folder exclusions. Process-based exclusions are scoped to the named process only and do not create open paths for malware to abuse. Test in audit mode for 48 hours before enforcing.
Why does Microsoft Defender for Endpoint cause high CPU on SQL Server or development machines but not on standard workstations?
SQL Server and development tools generate high volumes of file I/O events that MDE's real-time protection and telemetry collection must process. Standard workstations have fewer concurrent file operations. Add the SQL server executable (sqlservr.exe) and compiler binaries (msbuild.exe, cl.exe) to the Excluded processes list in Intune antivirus policy.
How do I repair a looping MsSense.exe service that keeps restarting and consuming high CPU on a Windows endpoint?
Run mpcmdrun.exe -resetplatform from C:\Program Files\Windows Defender as administrator. If the loop continues, offboard the device using the Intune offboarding package, then re-onboard using a fresh onboarding package from the Defender security portal. Check the SENSE event log for error events 7 or 15 that indicate the root cause.
Can running Microsoft Defender for Endpoint in passive mode alongside a third-party EDR agent reduce high CPU usage?
Yes. Passive mode lets MDE collect telemetry while deferring real-time protection to the third-party agent, which significantly reduces MsSense.exe CPU. Set the registry key HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\ForceDefenderPassiveMode to 1, or configure it via Intune device configuration profile. Do not run two active EDR agents simultaneously.
What Windows Performance Monitor counters should I use to measure MDE CPU impact after making exclusion or scan schedule changes?
In perfmon.exe, add % Processor Time for the MsSense.exe and MsMpEng.exe instances. Capture a 15-minute baseline during peak business activity. MsSense.exe should stay below 5% during normal operations; MsMpEng.exe should stay below 10% outside of scheduled scan windows. Use Windows Performance Recorder if CPU remains elevated for a detailed trace.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.