MsMpEng.exe and Windows 2012 deduplication RRS feed

  • Question

  • Looking at the disk activity on our server I can see a lot of MsMpEng.exe processes reading .ccc .cd & .cd.new files located the a X:\System Volume information\ Dedupe\ChunkStore location.Disk activity isn't huge but the MsMpEng.exe process is sat at  25% CPU fairly constantly.

    Is there any documentation or advice regarding excluding these file types from Microsoft Forefront Endpoint Protection? I suspect it isn't doing us any favours at the moment

    Friday, June 12, 2015 12:41 PM

All replies

  • Hi,

    I haven't found any document regarding excluding this files. Here is a blog that lists all the AV exclusions you might want to configure for Windows Server.


    Best Regards,


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Proposed as answer by Joyce L Tuesday, June 23, 2015 11:43 AM
    Monday, June 15, 2015 6:09 AM
  • Thank you for the list. We have excluded those files and seen a big IO improvement for the dedup processing. My assumption is that the AV will just see the original file and will perform the check there. There is no need to check the content of the .ccc and .cd.new files, essentially scanning the same file twice.

    Would be good if Microsoft could confirm this though, must be other people out there with the same situation

    Tuesday, June 23, 2015 11:54 AM