I moved my Windows Update and Recover from Domain to After my Antivirus installation, which of course turns of Defender as it takes over from Defender. First pass through, now working.
What is sad is that this task sequence order for Updates and Recover from domain, has remained unchanged for close on a decade (I've been using MDT since late 2009). How Msoft manage to mess this up for their own product is beyond me.