Which edition did you run it on, and did re-enable hold?

[SysAdminDoc]

Defender's behavior shifts across Windows editions and management states, and this thread maps the ground I can't cover alone.

If you've run Defender Control, post your edition and build (Home, Pro, Enterprise, LTSC, and the winver number), and whether both directions worked: disable, and then a clean re-enable afterward. The re-enable is the half I care about most, because a tool that can turn something off but not reliably back on is a liability, not a utility.

One thing that trips people up: if your machine has Defender for Endpoint or is running Defender in passive mode behind another AV, the behavior is different and sometimes confusing. If that's you, say so, it's exactly the preflight case on the roadmap and your report helps shape it.