Never used it before, but that FileActivityWatch utility may also work well for this case.

oh it's the value, not the version

My image still has that disabled.

Writeconfig filter as well

but a bunch of other things are not optimized

yea just checked another machine. 30GB vdiskdif 🤦‍♂️

and no changes to C drive either. same size as at boot

and yea its totally inconsistent I have been sitting look at the server and zero change to cache. I am guessing this is happening in spurts

the slow spurts are harder to see, however you can log the changes in excel format to the write-cache drive or somewhere else

I asked the sccm guys to disable it when I saw it was on earlier this year.

@Steve Noel folderchangeview saves the day. its

only question is wtf is it downloading

i can see cache filling up in front of my eyes 😄

ok well mystery solved. Now just need to figure out the updates. Thanks again @Steve Noel. Your help was HUGE.

I downloaded "folderchangesview" about 2 months ago, and security was all over me like stink on poop. it flagged something in their scanners. But yea they have some great tools.

And before Kasper says it, yes, I feel bad about not just writing a blog about it.

Gonna write one blog, on Defender, and dedicate it to Kasper.

Basically, you're telling Windows Update to only use loopback for updates. This will prevent Defender updates from coming down, as well, which is why you also need to set the Define the order of sources... setting to both your local fileshare where the updates are downloaded to as well as MMPC, which is Microsoft's dedicated hosting site for Defender updates. It's usually a last resort option, as the downloads are larger in size, but it works fine for this method.

Also worth noting that this setting must be baked into your image, as it requires a reboot to take effect. I have it enabled via GPO just for enforcement, but I do bake it in with my sealing script:

Write-Host "Updating Defender..." -ForegroundColor Yellow -NoNewLine
Start-Process "C:\Program Files\Windows Defender\MpCmdRun.exe" -ArgumentList "-RemoveDefinitions -DynamicSignatures" -Wait -PassThru | Out-Null
Start-Process "C:\Program Files\Windows Defender\MpCmdRun.exe" -ArgumentList "-SignatureUpdate" -Wait -PassThru | Out-Null
Write-Host " Done" -ForegroundColor Green

Write-Host "Scanning the image with Defender..." -ForegroundColor Yellow -NoNewLine
Start-MpScan -ScanType FullScan
Write-Host " Done" -ForegroundColor Green

Write-Host "Configuring Defender..." -ForegroundColor Yellow -NoNewLine
Set-MpPreference -SharedSignaturesPath \\<http://domain.com|domain.com>\Citrix\WDAV\wdav-update
Set-MpPreference -SignatureDefinitionUpdateFileSharesSources \\<http://domain.com|domain.com>\Citrix\WDAV\wdav-update
Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $False
Set-MpPreference -SignatureFallbackOrder 'FileShares|MMPC'
Write-Host " Done" -ForegroundColor Green