diff --git a/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md index 98a8d61680..89647f9832 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md @@ -110,7 +110,7 @@ The package contains the following folders: | System Information| Contains a SystemInformation.txt file which lists system information such as OS version and network cards. | | Temp Directories| Contains a set of text files that lists the files located in %Temp% for every user in the system.

This can help to track suspicious files that an attacker may have dropped on the system.

NOTE: If the file contains the following message: “The system cannot find the path specified”, it means that there is no temp directory for this user, and might be because the user didn’t log in to the system.
| | Users and Groups| Provides a list of files that each represent a group and its members. | -|WdSupportLogs| Provides the MpCmdRunLog.txt and MPSupportFiles.cab | +|WdSupportLogs| Provides the MpCmdRunLog.txt and MPSupportFiles.cab

NOTE: This folder will only be created on Windows 10, version 1709 or later with February 2020 update rollup or more recent installed:
Win10 1709 (RS3) Build 16299.1717 : [KB4537816](https://support.microsoft.com/en-us/help/4537816/windows-10-update-kb4537816)
Win10 1803 (RS4) Build 17134.1345 : [KB4537795](https://support.microsoft.com/en-us/help/4537795/windows-10-update-kb4537795)
Win10 1809 (RS5) Build 17763.1075 : [KB4537818](https://support.microsoft.com/en-us/help/4537818/windows-10-update-kb4537818)
Win10 1903/1909 (19h1/19h2) Builds 18362.693 and 18363.693 : [KB4535996](https://support.microsoft.com/en-us/help/4535996/windows-10-update-kb4535996)
| | CollectionSummaryReport.xls| This file is a summary of the investigation package collection, it contains the list of data points, the command used to extract the data, the execution status, and the error code in case of failure. You can use this report to track if the package includes all the expected data and identify if there were any errors. | ## Run Microsoft Defender Antivirus scan on devices