i believe there is a switch in the MSI installation to toggle the option, take a look in the MSI FAQ text file on the CD in the documentation folder.

Well, there is indeed a line in the MSI FAQ that lists the toggle for not turning defender off:

DISABLEDEFENDER=0

What the MSI FAQ doesn't really do, unfortunately, is explain how/where you use these commands. Where do I put that line, or how do I use it?

The last line of that document gives you an example of the command line:

setup /s /v"/l*v log.txt /qn RUNLIVEUPDATE=0 REBOOT=REALLYSUPPRESS"

change it to:

setup /s /v"/l*v log.txt /qn RUNLIVEUPDATE=0 REBOOT=REALLYSUPPRESS DISABLEDEFENDER=0"

I saw that line, but it doesn't mean much to me -- in the absence of any other information, I don't really know what that line does. DOS says "setup" isn't a valid command.

And how do I use that command line in conjunction with the deployment wizard, so I can push this out to client computers in blocks of 15 or 30 computers at once?

You have to run the command from the folder where the installation files are located either by running it from the folder in the command prompt:

Copy installation files to c:\sep-clnt

c:

cd\sep-clnt

setup /s /v"/l*v log.txt /qn RUNLIVEUPDATE=0 REBOOT=REALLYSUPPRESS DISABLEDEFENDER=0"

OR by specifying the path to the setup file in the Start/Run command:

copy installation files to c:\sep-clnt

Start/Run

c:\sep-clnt\setup /s /v"/l*v log.txt /qn RUNLIVEUPDATE=0 REBOOT=REALLYSUPPRESS DISABLEDEFENDER=0"

Okay, I guess that makes sense for the local install. Does that work if you want to push the install to another computer, though? We're looking at upgrading ~500 computers at the office here, and if I have to do that individually on every machine, that's far more work than pushing from the SEPM and just telling every client that they need to reactivate Defender.

that looks about right to me

Sorry for the slow reply on this on, but this technique appears to be working perfectly. Thanks for the suggestion!