@Andy Ful without me reading all 91 pages of posts... (I normally use danb's DefenderUI but on this VM I only use MSD and
your tools), and my Defender systray icon has a yellow flag

and it says Tamper Protection is Off. I assume I ran ConfigureDefender at default (or max or recommended) so should Tamper protection be off. should I just turn it ON from system Windows Security, or open ConfigureDefender and run it again? ie, is it normal for Tamper to be off after running CD?