Hi, my PC's secondary HDD gets periodically spun up by MsMpeng.exe doing just a couple of IRP_MN_QUERY_INFORMATION operations on the D:\Programs folder (as observed from Process Monitor). Otherwise, the HDD remains in the spun-down state as expected.
Set aside that I have excluded the whole D: directory in Defender settings, I've tried looking at the Defender scheduled tasks at least to prolong the interval at which these operations are executed, but the scheduled tasks are relative to MpCmdRun.exe, not MsMpEng.exe.
I couldn't find any information about this on the web nor on Microsoft Docs, what's the difference between MsMpEng.exe and MpCmdRun.exe? Is it possible to take control of MsMpEng.exe scheduled activity?
Thanks to anyone that will help :)
(Windows 10 Home)