I definitely had Windows Defender enable itself (and delete some files I wanted to keep). It was pretty frustrating. I disabled it in group policy which should [i hope?] keep it off.