Does anyone have any recommendations for optimizing Windows Defender Advanced Threat Protection for VDI desktops? Have a client using it and noticing some CPU spikes, and I figured I would ask before I start trying to Google it

Quick-hit list for Defender for Endpoint (the current name for Defender ATP) on VDI: Shared security intelligence: point VMs at a UNC share via the “Define security intelligence location for VDI clients” GPO. Extraction of definition updates then happens on a host machine, sparing CPU, disk, and memory on the non-persistent VMs. This is usually the biggest win for spikes at boot or sign-in. Cache maintenance on the golden image: run it before sealing so each clone doesn’t rebuild the cache at first boot. Randomize scheduled scans: use quick scans rather than full ones, with randomized start times so the VMs don’t all scan at once. Cap scan CPU: lower ScanAverageCPULoadFactor (default 50%) and enable idle-only scanning or low-priority scheduled scans. FSLogix exclusions: exclude the profile container VHD/VHDX files and paths, and have them in place before first user logon. Don’t onboard the golden image: stage the onboarding script to run only on child VMs, using the non-persistent VDI onboarding package (single entry per device name). Find the actual culprit: run Defender’s performance analyzer (New-MpPerformanceRecording / Get-MpPerformanceReport) to see which files and processes are driving MsMpEng CPU, then add targeted exclusions only. Keep the platform and engine current: bake the latest updates into the image so clones don’t all update at boot. Keep real-time and cloud-delivered protection on: tune around them rather than disabling them.

Here is my info on definition offloading and update automation. docs.jeffriechers.com/Microsoft/vdi-defender-offloading