I used ProcMon to capture Word starting up in our environment and the top three files sorted by file time are:
1) C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-xxxxxxx.bin.VE0 - 7.6s
2) Microsoft dll - 6.1s
3) C:\Program Files\Common Files\McAfee\Engine\mferuntime-xxxxxxx.dat - 5.4s
The fourth file is 3s and then it drops off with many resources accessed for under half a second.
I believe the McAfee dat file is used so often on first launch because we have "Processes on Enable" selected. The dat file usage is not present for subsequent launches of Word. However, since the windows defender service is still running and set to automatic startup I think I could get better performance by disabling the service, as we do have the McAfee anti-spyware module installed. When I disable Windows Defender service that WD file no longer appears in my captures.
Is there any McAfee documentation that covers Windows Defender? Has anyone else disabled Windows Defender (GPO or script) when they saw this condition?
Just one remark, if you manage the roll out via ePO there will be no popup for the end user it happens all silently. I don't think there is documentation on WD, it is disbaled on install and enabled upon uninstall, all good. You can try to invoke the setupvse.exe with /q, that should make the whole process silent again. Installation Guide has more switches if required :-).