diff --git a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md
index 87c74a4998..9883e2ee86 100644
--- a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md
+++ b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md
@@ -23,6 +23,7 @@ ms.technology: mde
 
 
 This auditing subcategory should not have any events in it, but for some reason Success auditing will enable generation of event 4985(S): The state of a transaction has changed.
+This refers to : https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4985 - (4985(S): The state of a transaction has changed. used by the file system transaction manager.
 
 | Computer Type     | General Success | General Failure | Stronger Success | Stronger Failure | Comments                                                              |
 |-------------------|-----------------|-----------------|------------------|------------------|-----------------------------------------------------------------------|