There seems to be what I believe is a Norton install bug under Windows 10. Actually it is a re-install bug. The registry values DisableAntiSpyware and DisableAntiVirus for HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsDefender were left with value "0" instead of "1" upon re-install of Norton Internet Security, so Windows Defender was still at least partially enabled. The observed symptom was that Windows Update kept failing due to trying to update Windows Defender definitions even though the Norton install had somewhat disabled Defender (and I had set the Defender Settings value to disabled before re-installing Norton).
I fixed the problem by temporarily taking ownership of the WindowsDefender registry key from System and patching in the right values for those two fields. Regedit had indicated that a TrustedInstaller such as Norton has write permission to the WindowsDefender key, so this appears to be a bug in Norton. I had noticed those values were set to "1" on another machine where Norton was installed, but never uninstalled then reinstalled like on my PC. On yet another Windows 10 box where Norton was never installed, DisableAntiVirus and DisableAntiSpyware were not present, but their presence with a value of "0" should be indicative of the same state as their absence, I would think.
I am hoping Norton will address this, as modifying the registry, especially mucking with key permissions is ugly stuff.