IIRC, there is a group policy setting called "Turn off routine remediation" to stop defender from auto-removing stuff. There is also a setting to permanently d

IIRC, there is a group policy setting called "Turn off routine remediation" to stop defender from auto-removing stuff. There is also a setting to permanently disable automatic sample reporting. I enabled that on all my Windows machines after the first time I caught Defender exfiltrating sensitive files like places.sqlite database out of my FF profile directory.