Defender for Endpoint - Unified onboarding failed on 2012 R2 - MpAsDesc.dll 310

None of this worked for us, most of the time we are able to install after 2 or 3 retries.
1st install fails,
1st retry it will detect Windefend service, try to uninstall it,
Reboot needed
2nd retry, it works or we have to go again for another reboot and after that it works.

Upgrading on 2016 having been really easy and we have around 500 servers with unified onboarding without need for manual intervention.
2012 R2 we are at 75 servers and we had to manually install and multiple reboot due to this issues on almost 50% of servers.

It's not the end of the story, we just discovered MSSense high cpu usage on some 2012 R2 servers and first analysis from procmon show endless "Query Directory" C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\*.cat

To be honest, right now we are reconsidering switch to defender for 2012 R2 as it seems not reliable.