diff --git a/windows/security/threat-protection/auditing/event-5155.md b/windows/security/threat-protection/auditing/event-5155.md index ac2e1deec7..d64947b8c8 100644 --- a/windows/security/threat-protection/auditing/event-5155.md +++ b/windows/security/threat-protection/auditing/event-5155.md @@ -86,7 +86,7 @@ This event generates every time the [Windows Filtering Platform](https://docs.mi -- **Application Name** \[Type = UnicodeString\]**:** full path and the name of the executable for the process. +- **Application Name** \[Type = UnicodeString\]**:** Full path and the name of the executable for the process. Logical disk is displayed in format \\device\\harddiskvolume\#. You can get all local volume numbers by using **diskpart** utility. The command to get volume numbers using diskpart is “**list volume”**: