diff --git a/windows/security/threat-protection/auditing/event-5155.md b/windows/security/threat-protection/auditing/event-5155.md
index a0f9323cf9..f1ecd05750 100644
--- a/windows/security/threat-protection/auditing/event-5155.md
+++ b/windows/security/threat-protection/auditing/event-5155.md
@@ -88,7 +88,7 @@ This event generates every time the [Windows Filtering Platform](https://docs.mi
 
 -   **Application Name** \[Type = UnicodeString\]**:** Full path and the name of the executable for the process.
 
-    Logical disk is displayed in format \\device\\harddiskvolume\#. You can get all local volume numbers by using **diskpart** utility. The command to get volume numbers using diskpart is “**list volume”**:
+    Logical disk is displayed in the format \\device\\harddiskvolume\#. You can get all local volume numbers by using the **diskpart** utility. The command to get volume numbers using diskpart is “**list volume**”:
 
 <img src="images/diskpart.png" alt="DiskPart illustration" width="786" height="246" />