I just got an AV alert from Defender, because gpupdate wanted to disable it (as I configured on my DC).

This wouldn't be as frustrating if Defender didn't kill all my performance by constantly scraping disks...