From 0d1f7e1ad7db5d78c554214a1e0917b0f9fa5f67 Mon Sep 17 00:00:00 2001
From: Jose Sua <josesua@microsoft.com>
Date: Mon, 31 Aug 2020 14:09:34 -0700
Subject: [PATCH] Update event-4698.md

---
 .../security/threat-protection/auditing/event-4698.md | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/windows/security/threat-protection/auditing/event-4698.md b/windows/security/threat-protection/auditing/event-4698.md
index 2742b717ce..d848e88861 100644
--- a/windows/security/threat-protection/auditing/event-4698.md
+++ b/windows/security/threat-protection/auditing/event-4698.md
@@ -62,6 +62,17 @@ This event generates every time a new scheduled task is created.
  </Event>
 
 ```
+>[!NOTE]
+> Windows 10 Versions 1903 and above augments the event with these additional properties:
+> Event Version 1.
+>  ***Event XML:***
+>```
+>  <Data Name="ClientProcessStartKey">5066549580796854</Data> 
+>  <Data Name="ClientProcessId">3932</Data> 
+>  <Data Name="ParentProcessId">5304</Data> 
+>  <Data Name="RpcCallClientLocality">0</Data> 
+>  <Data Name="FQDN">DESKTOP-Name</Data> 
+
 
 ***Required Server Roles:*** None.