We use SCEP through SCCM and have a specific server that we can't work on because the msmpeng.exe process is using 99% of the CPU.  Is there some way I can find out what the heck it's scanning that's causing the problems?

I recommended using Sysinternals Process Monitor to run a trace and then filter on MsMpEng.exe to see its activity:

https://technet.microsoft.com/en-us/sysinternals/bb896645

You can also try Process Explorer and look at the threads being used by MsMpEng.exe. Sometimes that can give useful information:

https://technet.microsoft.com/en-us/sysinternals/bb896653

• Edited by KevinMJohnston 12 hours 57 minutes ago

I recommended using Sysinternals Process Monitor to run a trace and then filter on MsMpEng.exe to see its activity:

https://technet.microsoft.com/en-us/sysinternals/bb896645

You can also try Process Explorer and look at the threads being used by MsMpEng.exe. Sometimes that can give useful information:

https://technet.microsoft.com/en-us/sysinternals/bb896653

• Edited by KevinMJohnston Wednesday, July 29, 2015 6:29 PM

I recommended using Sysinternals Process Monitor to run a trace and then filter on MsMpEng.exe to see its activity:

https://technet.microsoft.com/en-us/sysinternals/bb896645

You can also try Process Explorer and look at the threads being used by MsMpEng.exe. Sometimes that can give useful information:

https://technet.microsoft.com/en-us/sysinternals/bb896653

• Edited by KevinMJohnston Wednesday, July 29, 2015 6:29 PM