Question MsMpEng.exe writing several gigs a day when PC is idle, "periodic" tasks running every day.

[fishyjack]

I only noticed this when after updating my CPU Chipset drivers, in HWInfo64 that my boot drive was doing a lot of writing while I was monitoring CPU temps.

MsMpEng.exe, whenever the PC is idle for more than a few minutes, starts writing. This coincides with the, "Windows Defender Cache Maintenance", "Windows Defender Cleanup", "Windows Defender Scheduled Scan" and "Windows Defender Verification" tasks activating in Task Scheduler, Microsoft/Windows/Windows Defender.

I've added a weekly trigger condition to the "Windows Defender Scheduled Scan" task but it still seems to activate whenever idle. However, it used to write 10.5 gigs every day but after adding the trigger, it now only writes 3-7.

My boot-drive size doesn't change so it's not being filled up. It's currently 140 gigs free out of 250 gigs and it stays that way the entire time MsMpEng is doing it's thing. I've also noticed via Resource Monitor that "System" is writing to 1-3 temp files in C:/Windows/Temp and deletes the files when it's done. The file names are TMP + random numbers and letters. All tasks also stop immediately whenever my PC is no longer idle (ie, I wiggle my mouse).

I'm not actually experiencing any problems aside from slightly spiked CPU/SSD temps and a bit of weariness of extra gigs being written to my bootdrive. In Task Scheduler, it describes the tasks as "periodic" which is fine but every single day feels a bit excessive.

Am I actually able to change the schedule of when it does this? I'm fine with it doing routine stuff, just not every single day. Any insight is appreciated.

Specs:

Windows 10 Pro 22H2 19045.5247
Samsung 870 Evo 250gig boot drive

 

[BFG-9000]

This has been an issue for at least 8 years, and the best guess is that Defender is decompressing large compressed files into the temp directory for scanning.

If you have large .zip or .iso or other large compressed files on local disk it's probably a good idea to try excluding them or moving them off to a NAS to see if the problem goes away.

 

[fishyjack]

This has been an issue for at least 8 years, and the best guess is that Defender is decompressing large compressed files into the temp directory for scanning.

If you have large .zip or .iso or other large compressed files on local disk it's probably a good idea to try excluding them or moving them off to a NAS to see if the problem goes away.

Hmm .. I did have some compressed backup zips, some of them around the 300-400 mb range as well as a stray nvidia driver installer which was around 700mb. Are those large enough to trigger it? Aside from that, I don't have large compressed files on my local disk, I move them all to my storage drive generally.

 

[BFG-9000]

Well if they are on any local disk, Defender may still regularly scan them after decompressing them onto a temp file on C: depending on how recently they were used. It doesn't seem to scan files on networked drives until you access them though.

I wonder how many writes you'd see when using the Compact OS feature which compresses all Windows binaries?