Fix High CPU Usage on Windows 11
Windows 11 CPU stuck near 100%? Find the process in Task Manager, then tame the usual causes — Defender scans, WMI, indexing, and too many startup apps.
If Windows 11 feels sluggish and the fan is loud, open Task Manager and check the CPU column — one process is usually eating the cycles. Press Ctrl+Shift+Esc, click the CPU column on the Processes tab to sort, and deal with whatever sits on top. Most cases come down to Microsoft Defender scanning, a background service, or too many startup apps. On Windows 11 24H2, watch specifically for the System process sitting high at idle, which has been tied to older NVIDIA display drivers, and for File Explorer spiking after the upgrade while indexing and shell extensions catch up.
Find the process first
On the Processes tab, click the CPU column header to sort highest-first; the Performance tab shows the overall load and a graph. Watch for a minute — a short spike after boot or during an update is normal. If one name stays at the top, that is your target, and the common offenders each have a specific, safe fix rather than “end task.”
| Process | What it is | Fix |
|---|---|---|
| Antimalware Service Executable | Defender real-time scan | Add an exclusion or reschedule the scan |
| WMI Provider Host | A program querying the system | Find the client process, don’t kill it |
| SysMain / SearchIndexer | Preload and search index | Pause or disable if it thrashes |
| Many browser tabs | Background pages | Close tabs, check extensions |
Tame Microsoft Defender without turning it off
Antimalware Service Executable is Defender scanning in the background, and it spikes hardest during a full scan. Do not disable Defender. Instead reschedule the scan, or add an exclusion for a large, trusted folder under Settings, Privacy & security, Windows Security, Virus & threat protection, Manage settings, Exclusions. Keep exclusions few and temporary, since each one is a gap in protection.
Track down WMI Provider Host
If WMI Provider Host (WmiPrvSE.exe) is high, some other program is hammering it — ending it is not the fix. Note its process ID in Task Manager, then open Event Viewer and go to Applications and Services Logs, Microsoft, Windows, WMI-Activity, Operational. The ClientProcessId in those events points back to the real culprit, which you then update or remove.
The general clean-up
When no single process dominates, work through the basics: restart, install Windows updates, trim startup entries on the Task Manager Startup apps tab, and run sfc /scannow followed by DISM /Online /Cleanup-Image /RestoreHealth in an elevated terminal. Run a full malware scan too, since hidden coin miners show up as steady, unexplained load. If the disk is also pinned, 100% disk usage has its own fixes; if the machine locks up under load, see why Windows 11 keeps freezing. Cutting startup programs is the single change that helps most PCs.
Fix the top process before touching anything else — most high-CPU cases are one scan, one service, or one runaway app. Disabling Defender or core services trades a slow PC for an unsafe one, so leave those on.
Common questions
The System process shows high CPU on Windows 11 24H2. How do I fix it?
On many PCs this traces to an older NVIDIA display driver interacting with the 24H2 kernel. Do a clean install of the latest NVIDIA driver, and update the chipset driver from your PC or motherboard maker too.
Why is Antimalware Service Executable using so much CPU?
That is Microsoft Defender scanning in the background, and it spikes hardest during a full scan. Reschedule the scan or add an exclusion for a large, trusted folder rather than turning Defender off.
File Explorer is pinning my CPU after upgrading to 24H2. Is that normal?
Some load is expected right after the upgrade while the search index rebuilds and thumbnails regenerate. If it persists, disable third-party shell extensions and check OneDrive sync, which are the usual causes.
WMI Provider Host is high. Should I end it?
No. Another program is querying it, so ending it does not fix the cause. Note its process ID, then open Event Viewer’s WMI-Activity Operational log and read the ClientProcessId to find the real culprit.