In an attempt to claw back some CPU being consumed by MsMpEng.exe I added some executable that I trust to the exclusion list.
However, this had no effect on MsMpEng's CPU consumption. So I uses Procmon to see what was happening and MsMpEng was STILL opening and reading the executables I'd excluded.
So i tried turning OFF the realtime protection in Virus & threat protection settings. Still no change to the CPU consumption of MsMpEng and the excluded files still being opened and read!!
Why, when real-time protection is off is MsMpEng still opening and reading files in real-time?
