From 1c791fd89916f35635ddb5cc333568960b52397f Mon Sep 17 00:00:00 2001
From: Quentin BRUSA <122641985+qbrusa@users.noreply.github.com>
Date: Thu, 19 Jan 2023 09:03:05 -0500
Subject: [PATCH] Add missing link for EID 4902, 4907, 4904, 4905

---
 .../auditing/audit-audit-policy-change.md              | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/windows/security/threat-protection/auditing/audit-audit-policy-change.md b/windows/security/threat-protection/auditing/audit-audit-policy-change.md
index c5cdf8c616..74134a5bd9 100644
--- a/windows/security/threat-protection/auditing/audit-audit-policy-change.md
+++ b/windows/security/threat-protection/auditing/audit-audit-policy-change.md
@@ -49,13 +49,13 @@ Changes to audit policy that are audited include:
 
 The following events will be enabled with Success auditing in this subcategory:
 
--   4902(S): The Per-user audit policy table was created.
+-   [4902](event-4902.md)(S): The Per-user audit policy table was created.
 
--   4907(S): Auditing settings on object were changed.
+-   [4907](event-4907.md)(S): Auditing settings on object were changed.
 
--   4904(S): An attempt was made to register a security event source.
+-   [4904](event-4904.md)(S): An attempt was made to register a security event source.
 
--   4905(S): An attempt was made to unregister a security event source.
+-   [4905](event-4905.md)(S): An attempt was made to unregister a security event source.
 
 All other events in this subcategory will be logged regardless of the "Audit Policy Change" setting.
 
@@ -79,4 +79,4 @@ All other events in this subcategory will be logged regardless of the "Audit Pol
 
 -   [4904](event-4904.md)(S): An attempt was made to register a security event source.
 
--   [4905](event-4905.md)(S): An attempt was made to unregister a security event source.
\ No newline at end of file
+-   [4905](event-4905.md)(S): An attempt was made to unregister a security event source.