Defender update frequency normal?

BTW ... as you know ... with System Restore turned off it can't create any ... That was my whole idea turning it off. Macrium Reflect will hopefully save MA if I need it.

Yep :)

Well to add to the mystery, I had not gone back to check on the task being disabled since I did disable it. Well it was Enabled but not run! I disabled it again and now we wait and see ...

Yep, when the Windows Defender Antivirus Antimalware Platform is updated it resets/updates the 4 default WD Task so that they point to new/correct file location. (i.e. C:\ProgramData\Microsoft\Windows Defender\Platform\x.xx.xxxx)

FWIW ... I cleared my CBS log, then ran the following command and it's still trying to create restore points on my PC

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1809.2-0>MpCmdRun -IdleTask -TaskName WdVerification

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1809.2-0>

2018-09-25 20:21:22, Info CBS Exec: Creating restore point: Package: Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Installed, targeted: Installed
2018-09-25 20:21:22, Info CBS Restore point type: Install
2018-09-25 20:21:22, Info CBS Perf: Begin: nested restore point - begin
2018-09-25 20:21:22, Info CBS Failed setting restore point [HRESULT = 0x80070422 - ERROR_SERVICE_DISABLED]
2018-09-25 20:21:22, Info CBS Exec: Begin: nested restore point - failed, ignoring and continuing. [HRESULT = 0x80070422 - ERROR_SERVICE_DISABLED]


Note: It also created a new xxxx_xxxx.xml file in C:\Windows\servicing\Sessions

I've left Gayle's Laptop unchanged and been deleting them as they are created, DAILY. I'll sooner or later disable it there.

I really can't figure any of this out. My system restore is on and now no restore points after the verification task. You've got system restore off and it's still trying to create them. Doesn't make any sense. Then again, my situation might change tomorrow so I'll keep watching it. All I can say is -- it's Microsoft.

I hear you ... Only reason I went back and ran it manually from a command prompt was cause a couple of you said you weren't seeing it trying to create restore points in the CBS log after the KB4052623 update. So I was curious and hoping my initial manual run of the WD Verification Task was a fluke, that maybe it hadn't actually updated the task to point to the new file locations or something.