Windows defender silently removes stuff. I have an admin and a user account and there are no notifications on the user account when defender swings into action.
It took a lot of effort before I found the source of the strangeness and step one in any future troubleshooting will be to check the activity of defender before looking elsewhere.
The following command takes you to the defender history page
explorer windowsdefender://History
Sticking the line in notepad and saving with the extension .bat turns it into a clickable shortcut for the desktop.
These files have been flagged in some update and I have checked the download with virustotal and when you send it the download link it is all clear but a different result shows when you upload the download to virustotal it and yet another result after you unzip it. The majority vote is “in the clear” but It becomes a judgement call.
https://www.zamaudio.com/?p=976
When setting up Win11 you have to create a Mirosoft account but I set up a second admin account and deleted the account I linked to the Microsoft account and this had worked well to reduce disruptions. Windows defender refuses to launch in the admin account without signing in and that is just rude. The workaround is to create the same .bat file on the admin account and clicking it goes round the rude message. I am especially fond of the ZamTube plugin as it gives you a large variety of distortion algorithms, It is well worth the hassle.