intermittent issue with distributing defender updates to DP's

Hi all,

I am looking for help on an issue we have distributing Defender updates to the DP's. 

We have setup an ADR that checks for new defender updates every time the SUP synchronises. This runs well but we see intermittent errors when the updates are being distributed to the DP's. We have 44 DP's. 

Config Mgr version : 2303 

The error in smsdpprov.log on the dp's:

[13F0][Sun 06/18/2023 10:13:54]:MoveFile failed for \\?\D:\SCCMContentLib\DataLib\f9dd4fde-b00a-4bf5-97f1-5f10fe8e12cc.C0100358.temp to \\?\D:\SCCMContentLib\DataLib\f9dd4fde-b00a-4bf5-97f1-5f10fe8e12cc
[13F0][Sun 06/18/2023 10:13:54]:FileRename failed; 0x80070005
[13F0][Sun 06/18/2023 10:13:54]:CContentDefinition::Finalize failed; 0x80070005
[13F0][Sun 06/18/2023 10:13:54]:Failed to finalize content 'f9dd4fde-b00a-4bf5-97f1-5f10fe8e12cc' for package 'C0100358'. Error code: 0X80070005

Error in PkgXferMgr.log on siteserver:

ExecStaticMethod failed (80041001) SMS_DistributionPoint, FinalizeContent SMS_PACKAGE_TRANSFER_MANAGER 6/20/2023 10:09:23 AM 118664 (0x1CF88)
CSendFileAction::SendContent failed; 0x80041001 SMS_PACKAGE_TRANSFER_MANAGER 6/20/2023 10:09:23 AM 118664 (0x1CF88)
Sending failed. Failure count = 2, Restart time = 6/20/2023 10:39:23 AM +0200 SMS_PACKAGE_TRANSFER_MANAGER 6/20/2023 10:09:23 AM 118664 (0x1CF88)

Some observations:

Sometimes DP's are able to distribute the content succesfully on the first go, but could fail with the next defender update.

On the next retry it is successful most of the times. Sometimes it needs multiple retries.

Because Defender updates are released frequently there are always a number of DP's in an error state. Never 100% succes.

We see this behavior on all of our dp's intermittently.

It also happens on DP's with fast connections to the SUP, so it does not seem to be bandwidth related

We don't have this issue with other applications we distribute to DP's. Even when they are larger in size  the Defender package. 

Defender package consists of thousands of small files when compared to other distributions. Could this somehow be related?

Read that it might be related to defender AV locking files, so temporarily disabled realtime protection on the DP and siteserver: No joy

Any help is appreciated.