Windows Security Health Service High CPU Usage: How to Fix It

Windows Security Health Service can attract attention for the wrong reason: a busy processor, a security window that keeps reopening, or a shield icon that never seems to settle. Before changing anything, check which executable is actually using resources. SecurityHealthService.exe, SecurityHealthSystray.exe, and MsMpEng.exe perform different jobs, even though their names all suggest Windows security.

The useful fix depends on that distinction. A stalled security dashboard needs a different investigation from an antivirus scan. This guide explains how to identify the busy component, check the security provider, repair Windows when necessary, and confirm that protection still works afterward.

The instructions focus on Windows 11. Windows 10 menu names differ, and its standard support ended on October 14, 2025; continued security updates require an eligible support arrangement. Microsoft's Windows support guidance.

What is Windows Security Health Service?

SecurityHealthService.exe helps supply protection-status information to the Windows Security app. It works with the Security Center service, wscsvc, so the dashboard can report on antivirus, firewall, and other protection, including compatible third-party products. Microsoft describes these status services separately from the antivirus engine. Disabling them can impair security reporting even when antivirus protection continues running. Microsoft's Windows Security documentation.

On a standard Windows installation, the first two executables are found under C:\Windows\System32. Use the path of the running process when checking a particular machine; finding a legitimate copy somewhere on the drive does not authenticate a different process with the same name.

Quick triage: choose the right starting point

There is no universal CPU percentage or time limit that proves a fault. Record whether the same process remains busy, whether the condition repeats after a restart, and whether it coincides with an update, scan, app launch, or error. A brief sample is a clue, not a diagnosis.

1. Identify the executable that is using resources

Press Ctrl + Shift + Esc to open Task Manager. Sort Processes by CPU, expand the relevant group, and use Go to details when available. Note the executable name and PID. If disk activity is the main symptom, sort by Disk as well; the busiest CPU process might not be the busiest disk user.

Right-click the relevant entry and choose Open file location. In the file's Properties, inspect the publisher and digital signature. For a read-only signature check, open PowerShell and replace the example path with the exact path you found:

Get-AuthenticodeSignature -LiteralPath 'C:\Windows\System32\SecurityHealthService.exe' |
    Select-Object Path, Status, @{Name='Signer';Expression={$_.SignerCertificate.Subject}}

Look for a valid Microsoft signature. A missing or invalid result needs investigation; it does not, by itself, prove malware. Signature checks can use either embedded or catalog signatures. Get-AuthenticodeSignature reference.

Next, close the Windows Security window and watch the same executable again. If only the interface quiets down, record that distinction. Avoid repeatedly ending the service: doing so may hide the symptom without resolving the cause.

If MsMpEng.exe is responsible, a scan or a frequently accessed workload may explain the load. Microsoft's Defender performance troubleshooting guide covers investigation of that engine. Do not add broad antivirus exclusions just to make the CPU graph look better.

2. Install Windows and Windows Security updates

Save your work and use Start > Power > Restart once. Then open Settings > Windows Update, install the offered updates, and complete any requested restart. On Windows 10, Windows Update is under Update & Security.

Windows 11 also receives updates for the Windows Security app and its underlying service through KB5007651. This is distinct from Defender security-intelligence updates. Use Windows Update first; if the app is broken, Microsoft's Windows Security app update page provides the supported package and its applicability. Choose the correct architecture and read the current page instead of downloading a replacement executable from another site.

If Windows Update returns an error, record the code and run the Windows Update troubleshooter in the Get Help app. Recheck after it finishes and after any required restart. Microsoft's troubleshooter instructions.

Do not confuse a successful update with a proven performance fix. Reproduce the original trigger and compare the same process afterward.

3. Check the antivirus provider Windows recognizes

Open Windows Security > Settings > Manage providers. Expand the antivirus category and identify the product responsible for protection. Open that product's own interface and check its status too. Microsoft's Windows Security settings guide explains this provider view.

This step is especially useful if the problem began after installing, removing, or upgrading an antivirus product. A disagreement between the product and Windows Security is evidence to investigate, not a reason to disable the status services.

Update or repair the intended antivirus using its vendor's instructions. If an old product did not uninstall cleanly, use that vendor's documented removal procedure. Avoid running several competing real-time antivirus products. On a work or school PC, ask the administrator to review provider registration rather than removing organization-managed protection.

After restarting, verify that the intended provider reports active protection. A disappearing tray warning alone is not enough to confirm success.

4. Look for repeated service or app crashes

Press Win + R, enter perfmon /rel, and open Reliability Monitor. Select the dates when the CPU problem occurred, then open the technical details of relevant application failures. Record the application name, faulting module, exception code, and time. Dell's Reliability Monitor guide illustrates this workflow.

A repeated SecurityHealthService.exe failure calls for a different next step from an unrelated application's crash. If the named module belongs to a third-party security product, include that detail in a report to its vendor. A Windows module such as ntdll.dll can be where a failure surfaced; its presence alone does not identify the original defect.

You can also compare the same time window in Event Viewer > Windows Logs > Application. Keep the relevant details before attempting repairs. If reporting activity itself becomes the main load, WerFault.exe may be collecting information about another component's repeated failures rather than causing the first failure.

5. Repair Windows components if the problem persists

When the app remains broken or the service continues failing after updates, open Terminal (Admin) or Command Prompt (Admin) and run these commands one at a time:

DISM.exe /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Let DISM finish before starting SFC. They repair the Windows image and protected system files; they do not promise to fix a third-party antivirus defect. Record any repair error rather than rerunning the commands indefinitely. Restart and test again after completion. Microsoft's System File Checker instructions.

Do not take ownership of protected security folders, delete SecurityHealthService.exe, or copy security DLLs from another computer. If a repair reports that required source files are unavailable, follow the specific repair error or escalate with the logs.

6. Scan when the evidence warrants it

An unusual executable path, an unexpected publisher, or other suspicious behavior justifies a malware check. Use your active antivirus. If Microsoft Defender is providing protection, open Windows Security > Virus & threat protection > Scan options and choose the appropriate scan. Save your work before using an offline scan because it restarts the PC. Microsoft's scan-options guide.

Measure performance after the scan finishes, not while the scanner is deliberately using CPU and disk resources. A legitimate signature and a clean scan are useful evidence, but neither replaces checking the original failure pattern.

7. Use a Windows repair reinstall if ordinary repairs fail

On supported Windows 11 systems, Settings > System > Recovery > Fix problems using Windows Update > Reinstall now repairs the current Windows version while preserving apps, files, and settings. Back up important files first and keep the PC connected to power and the internet. The option can be unavailable on managed devices or older builds. Microsoft's repair-reinstall instructions.

If the same failure survives a repair, collect the Windows build, Windows Security version, antivirus product/version, process name, and matching crash details for Microsoft or the security vendor. Avoid treating every security-status problem as a reason to reinstall the entire computer.

How to confirm the fix

Repeat the action that previously triggered the load: opening Windows Security, signing in, or letting the PC sit idle. Compare that with a period when no scan or update is active.

• The original executable no longer produces the recurring load under the same conditions.
• Windows Security opens and its provider information agrees with the installed protection product.
• New failures no longer appear at the times when the problem previously recurred.
• Protection remains enabled and updates complete normally.

Keep changes separate so you can tell which one helped. For an unrelated busy console host, use the conhost.exe high CPU guide; Windows servicing activity is covered in the Windows Modules Installer guide.

FAQ