Home › Knowledgebase › KB-640

How to fix Windows 11 high CPU usage caused by Windows Search or Antimalware Service Executable

Summary

This guide helps you troubleshoot and resolve: How to fix Windows 11 high CPU usage caused by Windows Search or Antimalware Service Executable. Follow the steps below to fix the issue.

Quick Tip: Need immediate assistance? 💻 Open a Ticket

Common Causes

This guide applies to Windows 11 on both desktop and laptop computers managed by 220 Internet Services. If your machine is part of a managed fleet, some settings may be controlled by group policy — contact us if a step is greyed out.

Quick Fix Steps

If you need immediate relief from a sluggish computer, try these steps in order. Each takes less than a minute.

  1. Press Ctrl + Shift + Esc to open Task Manager.
  2. Click the CPU column header to sort processes by usage.
  3. Look for SearchIndexer.exe (Windows Search) or MsMpEng.exe (Antimalware Service Executable).
  4. Right-click the offending process and choose End task.
  5. Wait 60 seconds. If CPU usage stays low, proceed to the detailed instructions below to prevent recurrence.
Ending MsMpEng.exe temporarily disables real-time malware protection. Windows Security will restart it automatically within a few minutes, but do not leave it disabled for extended periods.

Detailed Instructions

Identify the culprit process

Before making changes, confirm which background service is actually responsible for the high CPU load. Both Windows Search and Microsoft Defender Antivirus can spike CPU during routine maintenance, but sustained usage above 30–40% is abnormal.

  1. Right-click the Start button and select Task Manager.
  2. If Task Manager opens in compact mode, click More details at the bottom.
  3. Click the Processes tab, then click the CPU column header so the arrow points downward (highest usage at top).
  4. Note the process name and exact CPU percentage over a 2–3 minute period.
  5. Cross-reference:
    • SearchIndexer.exe — Windows Search indexer. Often spikes after large file copies, new user profiles, or corrupted index databases.
    • MsMpEng.exe — Antimalware Service Executable, the core engine of Microsoft Defender. Can spike during full scans, definition updates, or when scanning its own quarantine folder repeatedly.
    • SearchApp.exe or SearchHost.exe — the Windows Search UI and background host. Less common but can cause similar symptoms.
If neither process is responsible, see our guide on Optimizing Windows 11 Performance for broader diagnosis.

Fix 1: Rebuild the Windows Search index

If SearchIndexer.exe is the culprit, the most reliable long-term fix is rebuilding the search index from scratch. This clears corrupted entries and forces a fresh crawl of your files.

  1. Press Windows key + R, type control, and press Enter to open Control Panel.
  2. Set View by to Large icons, then click Indexing Options.
  3. Click the Advanced button. If prompted by User Account Control, click Yes.
  4. Under the Index Settings tab, click Rebuild.
  5. Click OK to confirm. The rebuild can take anywhere from 15 minutes to several hours depending on the number of files.
  6. Monitor CPU usage in Task Manager. The indexer will use significant CPU during the rebuild, but it should settle to near zero once complete.
Do not shut down or restart your computer during the rebuild. Interrupting the process can leave the index in a partially rebuilt state and require another rebuild.

Fix 2: Reduce Windows Search indexing scope

If rebuilding does not help, or if you have a small number of frequently accessed folders, consider limiting what Windows Search indexes.

  1. Open Indexing Options as described above.
  2. Click Modify.
  3. Uncheck any locations you do not need indexed, such as large media folders, backup drives, or network shares.
  4. Click OK, then Close.
  5. Restart the SearchIndexer.exe process from Task Manager by right-clicking it and selecting End task. Windows will restart it automatically with the new scope.

Fix 3: Exclude folders from Microsoft Defender scanning

If MsMpEng.exe is consuming excessive CPU, the most common cause is Defender repeatedly scanning its own working directories or a folder that changes frequently (such as a development workspace, database directory, or virtual machine storage). Adding exclusions can dramatically reduce CPU load without compromising overall protection.

  1. Press Windows key + I to open Settings.
  2. Click Privacy & security in the left sidebar, then Windows Security.
  3. Click Virus & threat protection.
  4. Under Virus & threat protection settings, click Manage settings.
  5. Scroll down to Exclusions and click Add or remove exclusions.
  6. Click Add an exclusion and choose Folder.
  7. Navigate to the folder that is being repeatedly scanned and click Select Folder.
  8. Repeat for any additional folders as needed.
  9. Restart your computer to apply the changes cleanly.
Only exclude folders you trust completely. Excluding a folder means Microsoft Defender will not scan files in that location for malware, even if you manually trigger a full scan.

Fix 4: Run a manual Defender scan to clear a stuck queue

Sometimes MsMpEng.exe gets stuck processing a large or malformed file. Running a manual scan can force the engine to complete its work and release the CPU.

  1. Open Windows Security from the Start menu or system tray icon.
  2. Click Virus & threat protection.
  3. Click Scan options.
  4. Select Full scan and click Scan now.
  5. Allow the scan to run to completion. This may take several hours on large drives.
  6. After the scan finishes, restart your computer and monitor CPU usage for 30 minutes.

Fix 5: Disable Windows Search temporarily (last resort)

If the indexer continues to misbehave after rebuilding and reducing scope, you can disable the Windows Search service entirely. This will break search functionality in File Explorer and the Start menu, but it will immediately stop SearchIndexer.exe from using CPU.

  1. Press Windows key + R, type services.msc, and press Enter.
  2. Scroll down to Windows Search in the list.
  3. Right-click Windows Search and select Properties.
  4. Set Startup type to Disabled.
  5. Click Stop to halt the service immediately.
  6. Click OK.
You can re-enable the service at any time by returning to the same window and setting Startup type back to Automatic (Delayed Start), then clicking Start.

Troubleshooting

CPU usage returns after a reboot

If the problem recurs after restarting, check the following:

SearchIndexer.exe still using high CPU after rebuild

If the indexer remains busy for more than a few hours after a rebuild, try the following:

MsMpEng.exe still using high CPU after exclusions

If Defender continues to use excessive CPU after adding exclusions, consider the following:

Still Having Issues?

Need more help? If the issue persists after trying these steps, please open a support ticket and our team will assist you.

💻 Open a Ticket