For headless Windows Server installations, Patch 17 reduced the memory footprint of the McShield.exe service from ~120MB to ~80MB during idle scans.
If you are stuck on Patch 17 due to budget or legacy application compatibility, here is how to harden it: