Microsoft Windows Defender can contribute to linked-clone OS disk growth and increase IOPS in linked clones and full virtual machines. Disable Windows Defender if you install other anti-spyware software on the virtual machine.
If Windows Defender is the only anti-spyware installed on the virtual machine, you might prefer to keep Windows Defender active on the desktops in your environment.