Merging changes synced from https://github.com/MicrosoftDocs/windows-docs-pr (branch live)

windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md

@@ -129,7 +129,8 @@ If you don't know the Store app publisher or product name, you can find them by
 
 If you need to add Windows 10 mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature.
 
->**Note**<br>Your PC and phone must be on the same wireless network.
+> [!NOTE]
+> Your PC and phone must be on the same wireless network.
 
 1. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**.
 
@@ -194,19 +195,19 @@ To add another Desktop app, click the ellipsis **…**. After you’ve entered t
  
 If you’re unsure about what to include for the publisher, you can run this PowerShell command:
 
-```ps1
+```powershell
 Get-AppLockerFileInformation -Path "<path_of_the_exe>"
 ```
 
 Where `"<path_of_the_exe>"` goes to the location of the app on the device. For example:
 
-```ps1
+```powershell
 Get-AppLockerFileInformation -Path "C:\Program Files\Windows NT\Accessories\wordpad.exe"
 ```
 
 In this example, you'd get the following info:
 
-```
+```console
 Path                   Publisher
 ----                   ---------
 %PROGRAMFILES%\WINDOWS NT\ACCESSORIES\WORDPAD.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US
@@ -335,6 +336,7 @@ The executable rule helps to create an AppLocker rule to sign any unsigned apps.
 
 12. After you’ve created your XML file, you need to import it by using Microsoft Intune.
 
+
 **To import a list of protected apps using Microsoft Intune**
 
 1. In **Protected apps**, click **Import apps**.
@@ -428,7 +430,7 @@ Separate multiple resources with the "|" delimiter.
 If you don’t use proxy servers, you must also include the "," delimiter just before the "|". 
 For example: 
 
-```code
+```console
 URL <,proxy>|URL <,proxy>
 ```
 
@@ -441,7 +443,7 @@ In this case, Windows blocks the connection by default.
 To stop Windows from automatically blocking these connections, you can add the `/*AppCompat*/` string to the setting. 
 For example: 
 
-```code
+```console
 URL <,proxy>|URL <,proxy>/*AppCompat*/
 ```
 
@@ -449,13 +451,13 @@ When you use this string, we recommend that you also turn on [Azure Active Direc
 
 Value format with proxy:
 
-```code
+```console
 contoso.sharepoint.com,contoso.internalproxy1.com|contoso.visualstudio.com,contoso.internalproxy2.com
 ```
 
 Value format without proxy:
 
-```code
+```console
 contoso.sharepoint.com,|contoso.visualstudio.com,|contoso.onedrive.com
 ```
 
@@ -465,7 +467,7 @@ Specify the domains used for identities in your environment.
 All traffic to the fully-qualified domains appearing in this list will be protected.
 Separate multiple domains with the "|" delimiter.
 
-```code
+```console
 exchange.contoso.com|contoso.com|region.contoso.com
 ```
 
@@ -475,7 +477,7 @@ Specify the DNS suffixes used in your environment.
 All traffic to the fully-qualified domains appearing in this list will be protected.
 Separate multiple resources with the "," delimiter.
 
-```code
+```console
 corp.contoso.com,region.contoso.com
 ```
 
@@ -488,7 +490,7 @@ This list shouldn’t include any servers listed in your Internal proxy servers
 Internal proxy servers must be used only for WIP-protected (enterprise) traffic.
 Separate multiple resources with the ";" delimiter.
 
-```code
+```console
 proxy.contoso.com:80;proxy2.contoso.com:443
 ```
 
@@ -500,7 +502,7 @@ This list shouldn’t include any servers listed in your Proxy servers list.
 Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic.
 Separate multiple resources with the ";" delimiter.
 
-```code
+```console
 contoso.internalproxy1.com;contoso.internalproxy2.com
 ```
 
@@ -539,7 +541,7 @@ Specify your authentication redirection endpoints for your company.
 These locations are considered enterprise or personal, based on the context of the connection before the redirection.
 Separate multiple resources with the "," delimiter.
 
-```code
+```console
 sts.contoso.com,sts.contoso2.com
 ```
 

windows/security/threat-protection/auditing/event-4626.md

@@ -1,6 +1,6 @@
 ---
 title: 4626(S) User/Device claims information. (Windows 10)
-description: Describes security event 4626(S) User/Device claims information.
+description: Describes security event 4626(S) User/Device claims information. This event is generated for new account logons.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4627.md

@@ -1,6 +1,6 @@
 ---
 title: 4627(S) Group membership information. (Windows 10)
-description: Describes security event 4627(S) Group membership information.
+description: Describes security event 4627(S) Group membership information. This event is generated with event 4624(S) An account was successfully logged on.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4634.md

@@ -1,6 +1,6 @@
 ---
 title: 4634(S) An account was logged off. (Windows 10)
-description: Describes security event 4634(S) An account was logged off.
+description: Describes security event 4634(S) An account was logged off. This event is generated when a logon session is terminated and no longer exists.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4647.md

@@ -1,6 +1,6 @@
 ---
 title: 4647(S) User initiated logoff. (Windows 10)
-description: Describes security event 4647(S) User initiated logoff.
+description: Describes security event 4647(S) User initiated logoff. This event is generated when a logoff is initiated. No further user-initiated activity can occur.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4649.md

@@ -1,6 +1,6 @@
 ---
 title: 4649(S) A replay attack was detected. (Windows 10)
-description: Describes security event 4649(S) A replay attack was detected.
+description: Describes security event 4649(S) A replay attack was detected. This event is generated when a KRB_AP_ERR_REPEAT Kerberos response is sent to the client.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4657.md

@@ -1,6 +1,6 @@
 ---
 title: 4657(S) A registry value was modified. (Windows 10)
-description: Describes security event 4657(S) A registry value was modified.
+description: Describes security event 4657(S) A registry value was modified. This event is generated when a registry key value is modified.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4658.md

@@ -1,6 +1,6 @@
 ---
 title: 4658(S) The handle to an object was closed. (Windows 10)
-description: Describes security event 4658(S) The handle to an object was closed.
+description: Describes security event 4658(S) The handle to an object was closed. This event is generated when the handle to an object is closed.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4660.md

@@ -1,6 +1,6 @@
 ---
 title: 4660(S) An object was deleted. (Windows 10)
-description: Describes security event 4660(S) An object was deleted.
+description: Describes security event 4660(S) An object was deleted. This event is generated when an object is deleted.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4673.md

@@ -1,6 +1,6 @@
 ---
 title: 4673(S, F) A privileged service was called. (Windows 10)
-description: Describes security event 4673(S, F) A privileged service was called.
+description: Describes security event 4673(S, F) A privileged service was called. This event is generated for an attempt to perform privileged system service operations.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4675.md

@@ -1,6 +1,6 @@
 ---
 title: 4675(S) SIDs were filtered. (Windows 10)
-description: Describes security event 4675(S) SIDs were filtered.
+description: Describes security event 4675(S) SIDs were filtered. This event is generated when SIDs were filtered for a specific Active Directory trust.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4688.md

@@ -1,6 +1,6 @@
 ---
 title: 4688(S) A new process has been created. (Windows 10)
-description: Describes security event 4688(S) A new process has been created.
+description: Describes security event 4688(S) A new process has been created. This event is generated when a new process starts.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4689.md

@@ -1,6 +1,6 @@
 ---
 title: 4689(S) A process has exited. (Windows 10)
-description: Describes security event 4689(S) A process has exited.
+description: Describes security event 4689(S) A process has exited. This event is generates when a process exits.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4698.md

@@ -1,6 +1,6 @@
 ---
 title: 4698(S) A scheduled task was created. (Windows 10)
-description: Describes security event 4698(S) A scheduled task was created.
+description: Describes security event 4698(S) A scheduled task was created. This event is generated when a scheduled task is created.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4699.md

@@ -1,6 +1,6 @@
 ---
 title: 4699(S) A scheduled task was deleted. (Windows 10)
-description: Describes security event 4699(S) A scheduled task was deleted.
+description: Describes security event 4699(S) A scheduled task was deleted. This event is generated every time a scheduled task is deleted.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4700.md

@@ -1,6 +1,6 @@
 ---
 title: 4700(S) A scheduled task was enabled. (Windows 10)
-description: Describes security event 4700(S) A scheduled task was enabled.
+description: Describes security event 4700(S) A scheduled task was enabled. This event is generated every time a scheduled task is enabled.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4701.md

@@ -1,6 +1,6 @@
 ---
 title: 4701(S) A scheduled task was disabled. (Windows 10)
-description: Describes security event 4701(S) A scheduled task was disabled.
+description: Describes security event 4701(S) A scheduled task was disabled. This event is generated every time a scheduled task is disabled.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4702.md

@@ -1,6 +1,6 @@
 ---
 title: 4702(S) A scheduled task was updated. (Windows 10)
-description: Describes security event 4702(S) A scheduled task was updated.
+description: Describes security event 4702(S) A scheduled task was updated. This event is generated when a scheduled task is updated/changed.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4703.md

@@ -1,6 +1,6 @@
 ---
 title: 4703(S) A user right was adjusted. (Windows 10)
-description: Describes security event 4703(S) A user right was adjusted.
+description: Describes security event 4703(S) A user right was adjusted. This event is generated when token privileges are enabled or disabled for a specific account.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4704.md

@@ -1,6 +1,6 @@
 ---
 title: 4704(S) A user right was assigned. (Windows 10)
-description: Describes security event 4704(S) A user right was assigned.
+description: Describes security event 4704(S) A user right was assigned. This event is generated when a user right is assigned to an account.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy

windows/security/threat-protection/auditing/event-4705.md

@@ -1,6 +1,6 @@
 ---
 title: 4705(S) A user right was removed. (Windows 10)
-description: Describes security event 4705(S) A user right was removed.
+description: Describes security event 4705(S) A user right was removed. This event is generated when a user right is removed from an account.
 ms.pagetype: security
 ms.prod: w10
 ms.mktglfcycl: deploy