Just to finish this off. If your org turns on all of the Defender ATP protection settings you will need them to put in an exception to turn off DEP for the following services:
code.exe (enter by name and not path)
PowershellProTools.Host.exe
PSScriptpad.exe