u/0GoodUsernamesLeft

Our RMM monitors for when WinDefend stops, and it has been happening for hours across much of our fleet today. Anyone else experiencing this? It starts a few seconds later, and in most cases will stop again at some point.

This post on Microsoft Learn suggests it's caused by an update (which makes sense):
https://learn.microsoft.com/en-us/answers/questions/5978509/is-there-any-way-to-fix-windows-defender-threat-se

Status Update: we did some counting. It is actually a small percentage of our fleet (about 5%), but they are so noisy. Among those 16 machines, they have been generating an average of one event with two notifications--one for the trigger and one for the reset--every 10 minutes for the last 7 hours.