Have excluded a file in WDSC but MsMpEng.exe still opening it RRS feed

  • Question

  • In an attempt to claw back some CPU being consumed by MsMpEng.exe I added some executable that I trust to the exclusion list.

    However, this had no effect on MsMpEng's CPU consumption.  So I uses Procmon to see what was happening and MsMpEng was STILL opening and reading the executables I'd excluded.

    So i tried turning OFF the realtime protection in Virus & threat protection settings.  Still no change to the CPU consumption of MsMpEng and the excluded files still being opened and read!!

    Why, when real-time protection is off is MsMpEng still opening and reading files in real-time?

    Tuesday, April 3, 2018 3:56 AM