Defender update frequency normal?

Hmmm ... no restore point created today on my PC's, wonder what it'll do tomorrow ... lol

Desktop - All WD Task ran this morning 8/15/2018 @ 2:17 AM
Laptop = All WD Task ran this morning 8/15/2018 @ 8:52 AM

FWIW .. I did run across the following setting for WD, but I didn't check it before yesterday's CU, so ...
1. Don't know if it was False and the CU changed it to True (I believe the default is True).
2. If it actually has any affect on these restore points getting created.

Open PowserShell as Admin > Get-MpPreference
DisableRestorePoint : True

Note: I use MR as my trusted backup, but I do maintain one Restore Point (manually created). I have SR Size set low (~5GB), so if these Restore Points continue to be created ... I'll have to disable SR.

Wiley Coyote said:

Am surprised that so little attention is being voiced about it.

So am I, I believe this issue may be affecting most users that have enabled restore points and they just haven't noticed. I did a Google search and couldn't find a thing about this except for this thread and the one I started in a different sub forum. This needs to be brought attention to or it will never be fixed, anybody with a MS account (I don't have one nor want one) needs to post this problem in the community forums and see what they have to say. They likely will provide nothing helpful but it least it will bring some attention to it. I believe it is due to the last antimalware platform update that was installed 7/31 and I have had this problem every day since.

Well ... Both PC's created restore points today and I'm out of ideas on how to stop it, other than disabling System Restore. I don't think this is a bug per say, just something they've added to CYA in updating/fixing something else and since it appears it has to do with WD ... they sure ain't gonna tell us anything about it ... Hopefully, they'll fix/undo it soon :)

FWIW ... I have noticed something else, that I haven't seen/noticed before this started. I think it's associated with the WD Cleanup Task, but don't quote me on that. In the C:\Windows\servicing\Sessions folder I've noticed that xxxx_xxxx.xml / xxxx_xxxx.back.xml files are being created with the same time stamps as the WD Task time stamps. AFAIK, this has to do with the Component Based Servicing and maybe why MS is creating these restore points now ???

Note: You'll also find reference to these session numbers (xxxx_xxxx) under the following reg key...
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\SessionsPending

This is a snippet of my CBS.log and I don't even pretend to understand all the stuff in it, but the following is all I see that appears to do with these restore points and the Component Based Servicing (i.e. 30684462_1698231930 which is the name as one of the xml files referenced above)

Code:

2018-08-16 02:57:28, Info                  CBS    Exec: Processing  started.  Client: DISM Package Manager Provider, Session:  30684462_1698231930, Package:  Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~10.0.17134.1,  Identifier: Windows Foundation
2018-08-16 02:57:28, Info                  CBS    Exec: Using execution sequence: 92
2018-08-16 02:57:28, Info                  CBS    Reboot mark set
2018-08-16 02:57:28, Info                  CBS    Winlogon: Registering for CreateSession notifications
2018-08-16 02:57:28, Info                  CBS    Winlogon: Loading SysNotify DLL
2018-08-16 02:57:28, Info                  CBS    Winlogon: Starting notify server 
2018-08-16 02:57:28, Info                  CBS    Disabling LKG boot option
2018-08-16  02:57:28, Info                  CBS    Exec: Creating restore point:  Package:  Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~10.0.17134.1,  current: Installed, targeted: Installed
2018-08-16 02:57:28, Info                  CBS    Restore point type: Install
2018-08-16 02:57:28, Info                  CBS    Perf: Begin: nested restore point - begin
2018-08-16 02:57:33, Info                  CBS    Perf: Begin: nested restore point - complete

@Stitch194 .. I found the same in your CBS.log, just different session number.

Finally found this thread!

Just got Win 10 Pro 1803 this July 14 and I'm showing exactly the same as you guys. I found it because I am using CCleaner and there they are showing as of the beginning of this month. Shouldn't Microsoft be notified of what is going on?

Wiley Coyote said:

You can use the Feedback Hub.

I don't know how or if I can do that! I'm just a very old self taught noob going toward the eighties!

Well, I was on the phone with remote control with Microsoft for quite a while. The cust serv rep Amrinder Singh said there was nothing wrong with the system restore points and not to use CCleaner. I told her that others who don't have CCleaner also have the same problem. She spoke badly about this forum and said to use Microsoft for that. She created a manual restore point which turned out ok. I spoke with her supervisor who said that I would have to contact a technician. Then after the conversation I checked CCleaner and her restore point had disappeared from CCleaner soon after that. I then created another restore point and thus waiting if that one will disappear as well. TOTALLY DISGUSTED WITH MICROSOFT!!!

This is definitely NOT the Microsoft that I some time ago knew.

abuela101 said:

Finally found this thread!

Just got Win 10 Pro 1803 this July 14 and I'm showing exactly the same as you guys. I found it because I am using CCleaner and there they are showing as of the beginning of this month. Shouldn't Microsoft be notified of what is going on?

I deleted my restore points the other day via Control Panel/System Protection and regained about 16GB on the C drive, but the last time I checked these restore points were being created again. I have Macrium Reflect image backups as well, though, so not too worried.