Why is System writing to disk and MsMpEng.exe reading?

Question

Just a curiosity question. I just told Spotify to move its cache from one drive to another. When I now look at the Resource Monitor spotify.exe doesn't seem to be doing anything at all basically. There is, however, a great number of reads by something called MsMpEng.exe and a great number of writes by System. I can tell it's the Spotify cache being moved because of the file paths.

I've noticed this with other applications too, like when stuff is going really slow and I wonder whats going on. I check to see what is using my drives like crazy, but all I can see is System.

What's going on here? Why can I often not see exactly what application is causing the read/write activity?

Answer 1

I think you can try a clean boot. It was recommended on this blog.

http://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/msmpengexe-continuously-readingwriting-hard-disk/8f63751a-8f53-e011-8dfc-68b599b31bf5

I was having the same issue multiple writes of the MsMpEng that keep constantly the hard drive busy.

Try to keep a track of what is really happening in the system using the Resource monitor and external program such as process explorer.

Also, if you are running Windows 10. The culprit can be the CompatTelRunner.exe, that is the Microsoft Compatibility Appraiser.

You can follow this guide to disable it.

http://answers.microsoft.com/en-us/windows/forum/windows8_1-performance/disabling-windows-compatability-telemetry/f1437548-84ae-4421-9a07-45feb17cab86

In my case. Initially, I blame the MsMp program. However, the problem was the compatibility appraiser. You can check easily if it's the that stopping the service:

To do so, open PowerShell and run these commands:

stop-service diagtrack

If the high readings stop. Store the changes:

set-service diagtrack -startuptype disabled

Let me know, if those tips help you.