How to fix wdavdaemon high CPU usage on Mac (including wdavdaemon_unprivileged)

If your Mac has slowed to a crawl, Activity Monitor may be pointing the finger at wdavdaemon — or its companion process, wdavdaemon_unprivileged. Both are part of Microsoft Defender and are commonly installed on work Macs managed by an organization. While they normally run quietly in the background, they can sometimes spike your CPU and drag down performance. The good news: there are a few straightforward fixes. Here's what's causing the issue and how to fix wdavdaemon high CPU usage on your Mac (including wdavdaemon_unprivileged).

What is wdavdaemon?

wdavdaemon takes its name from Windows Defender Antivirus Daemon. It’s a process used by Microsoft Defender, and its presence on your Mac is probably explained by the fact that the Mac is currently or was at some point managed by an organization that used Defender to combat malware and protect its network. It may have been installed before the Mac was given to you or as part of the setup process when you first received it.

wdavdaemon and wdavdaemon_unprivileged: are they the same?

• Core daemon (wdavdaemon): The primary background service/daemon for Microsoft Defender on Mac that coordinates overall threat monitoring and core protection tasks.
• Unprivileged process (wdavdaemon_unprivileged): A segmented, lower-privilege helper process spawned by the main daemon to handle routine, high-risk tasks like file parsing, signature updates, and telemetry data collection safely without full system access.

Both can occasionally spike in CPU or memory when performing heavy real-time scans or updating definitions. 

Real-time threat monitoring needs to strike a balance between security and its use of resources. It may happen when OneDrive or iCloud actively syncs large volumes of files, and so Microsoft Defender has to scan each file.

How to check wdavdaemon CPU usage

There is a simple way to check how many CPU cycles wdavdaemon and wdavdaemon_unprivileged are using:

1. Go to Applications > Utilities and open Activity Monitor.
2. Click the CPU tab.
3. You will see processes listed in order of the CPU cycles they are using. Normally, the list starts with the highest consumers, and the arrow next to CPU at the top of the column points down. If that’s not the case, click the column header to see the highest consumers at the top.
4. Look for wdavdaemon and wdavdaemon_unprivileged on the list of all active processes.

How to fix wdavdaemon high CPU usage on your Mac (including wdavdaemon_unprivileged)

There are a couple of ways to fix high CPU usage of both processes in the long term. One is to update Windows Defender if there is an update available. The other is to uninstall it completely. However, if your Mac is managed by the organization you work for, those options may not be available to you. There are a few things you can try, however, that may help in the short term.

1. Check for malware

One reason wdavdaemon may use a lot of CPU on your Mac is that it has detected malware that is causing problems. Depending on the malware, Defender could use a lot of CPU cycles. To find out whether that’s the case, you need to scan your Mac for malware using a specialist cleaner tool. We recommend CleanMyMac’s Protection tool.

It scans your Mac looking for adware, ransomware, cryptocurrency miners, and other malware using its Moonlock technology. You can choose whether to run a deep, quick, or balanced scan. Also, you can choose whether to invoke the scan manually or have it run in the background and automatically detect threats. You can test CleanMyMac for 7 days — get your free trial here. 

Now, once you’ve installed CleanMyMac, here’s how to use it to find out if your Mac has been infected by malware:

1. Open CleanMyMac and choose the Protection tool in the sidebar.
2. Click Scan.
3. Wait for it to finish. If it finds anything suspicious, follow the instructions on the screen to remove it.
4. You can also click Review Found Threats to look at what CleanMyMac found. And then select what you want deleted and click Remove.

2. Restart your Mac in safe mode

When you boot into safe mode, it loads only those extensions needed for your Mac to start up. If a launch agent or extension is conflicting with wdavdaemon and causing it to use lots of CPU cycles, restarting in safe mode will reveal that. You can then restart normally, disable extensions in System Settings > General > Login Items & Extensions, and then turn them on again one by one until you find the culprit. You will need to restart normally each time you enable an extension.

There are different processes for rebooting in Safe mode on Apple Silicon and Intel Macs. You can find the process for your Mac on Apple’s website here.

3. Clear out system junk

System junk includes files like temporary files that were never deleted, old cache files, settings files for applications that are no longer on your Mac, and language files for languages you don’t use. As well as taking up space on your Mac, these files can cause conflicts with other files on your Mac, making it run slowly or become unstable. Whenever you experience a problem like wdavdaemon using lots of CPU cycles, it’s a good idea to clear out system junk. 

Doing that manually is difficult and time-consuming because you need to track down every junk file and drag it to the Trash. However, you don’t have to do it manually. CleanMyMac's Cleanup tool can do it for you with just a couple of clicks:

1. Once again, open CleanMyMac.
2. Click Cleanup > Scan > Clean.
3. You can also click Review All Junk and manually choose items to delete between System Junk, Mail Attachments, and Trash Bins.

4. Reinstall Windows Defender

Depending on how the Mac you’re using is configured, you may be able to reinstall Windows Defender. For example, if the organization managing it uses a mobile device management (MDM) tool, it may have installed a self-service app to allow you to install some applications and updates without the need for an admin password. Check to see if there is one installed on your Mac and, if so, whether it allows you to reinstall Windows Defender. If it does, use the reinstall option in the self-service app to reinstall Windows Defender. While you’re doing that, you could also use the app to update macOS. If not, you may need to speak to the organization’s IT support desk to reinstall it.

wdavdaemon and wdavdaemon_unprivileged are processes that run in the background on your Mac when Windows Defender is installed. Usually, they work very well and do their job without you even realizing they are there. However, you may sometimes notice that they have high CPU usage on your Mac. If that’s the case, follow the steps above to fix it and get your Mac running normally again.