MsMpEng.exe high CPU usage on Windows Server 2012

We analyzed the problem with Sysinternals ProcessMonitor, where we saw that MsMpEng.exe consumes much CPU time analyzing the log files of our web application (written by NLog).

Since we could not find a GUI to exclude the log files from MsMpEng.exe's real-time monitoring, we added it using regedit.exe.

The solution was to create a DWORD entry at

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths`

where the key of the entry is set to the full path of our log files (C:\inetpub\wwwroot\webapp\logs), and leaving the DWORD value at 0x00000000.


You might find it under Endpoint Protection or System Center Endpoint Protection, there you can set excluded filetypes and such under settings.