Antimalware service executable eats memory

Hi Alana,

I'm Ramesh, here to answer your query at the Microsoft Community.

1. Microsoft Defender consumes 200 - 300 MB of RAM during idle state, which is normal. However, the usage will increase during quick or full scans.
   
2. The "Your IT administrator has limited access" message may appear for several reasons. The Defender service configuration may be incorrect, malware may be present, or some registry-based policies may be in effect.

Please run the Farbar Scanner and share your logs for a detailed manual inspection of the startup items, services, scheduled tasks, etc.

Download Farbar Recovery Scan Tool 64-bit (FRST64.exe)
https://www.bleepingcomputer.com/download/farba...

Note: If Microsoft Edge or Chrome mislabels the Farbar Scanner executable as PUA/malware, choose to keep it by tapping … in the bottom bar, choosing Keep, and then choosing Keep anyway in the dialog that appears. See this screenshot: https://learn.microsoft.com/en-us/deployedge/me.... It's a safe tool used in most antimalware forums.

If the OS language is non-English, rename FRST64.exe to FRST64English.exe.

Run the program. Don't check or uncheck any options. Click "Scan".

Add the two logs, FRST.txt and Addition.txt, to a Zip archive, upload them to your OneDrive and share the link here.

References:

How-To: Share OneDrive files and folders - Microsoft Support
https://support.microsoft.com/en-us/office/shar...

OneDrive sharing options - screenshot
https://imgur.com/a/vZyxpY9

How to Run a Scan using Farbar Recovery Scan Tool:

https://www.winhelponline.com/blog/farbar-recov...

Standard Disclaimer: There is a link to a non-Microsoft website. The page appears to provide accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as PUPs (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.

here

https://1drv.ms/u/c/ca4f194cc18aebdc/EfkkuyW-7odOkvL5acbSx2YBvng9m286I2hysSvLPqPvBA?e=FarP9l

The following fixlist will remove the group policies and fix the UAC settings.

Download fixlist.txt (https://www.winhelponline.com/fixlist/alana_per...)

Save Fixlist.txt to the folder where FRST64English.exe is located.

Close all programs.

Launch the Farbar Scanner tool and click "Fix".

Restart Windows when prompted.

Upload the output log file (FixLog.txt) to your OneDrive.

NOTE: Don't run the same fixlist.txt more than once. The fixlist.txt script was written specifically for this user, for use on that particular machine. Running this on another machine is not recommended.

Standard Disclaimer: There is a link to a non-Microsoft website. The page appears to provide accurate, safe information, and it's a trusted MVP (2003-2012) site. Watch out for ads on the site that may advertise products frequently classified as PUPs (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.

Nope, still managed by my non existent administrator.

the fixlog thing if you need it Fixlog.txt

1. Is your system connected to a company network? If so, group policies are applied from the active directory.
2. Launch "services.msc" and start "Windows Security Service". Does the service start correctly?
3. From PowerShell admin, run this command to reinstall Windows Security: add-appxpackage -disabledevelopmentmode -register ((Get-AppxPackage Microsoft.Windows.SecHealthUI -allusers).InstallLocation + '\AppxManifest.xml')