There are 2 places where we're disabling defender: https://github.com/mozilla-platform-ops/ronin_puppet/blob/cloud_windows/provisioners/windows/azure/azure-bootstrap.ps1 https://github.com/mozilla-platform-ops/ronin_puppet/blob/cloud_windows/modules/roles_profiles/manifests/profiles/disable_services.pp We need to disable it within the bootstrap script.