From 536bdb57c57dcc8e454b42f496c74e4387750f6a Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Wed, 28 Aug 2019 15:30:39 +0500 Subject: [PATCH] Update windows/security/threat-protection/auditing/event-5155.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/security/threat-protection/auditing/event-5155.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-5155.md b/windows/security/threat-protection/auditing/event-5155.md index ac2e1deec7..d64947b8c8 100644 --- a/windows/security/threat-protection/auditing/event-5155.md +++ b/windows/security/threat-protection/auditing/event-5155.md @@ -86,7 +86,7 @@ This event generates every time the [Windows Filtering Platform](https://docs.mi -- **Application Name** \[Type = UnicodeString\]**:** full path and the name of the executable for the process. +- **Application Name** \[Type = UnicodeString\]**:** Full path and the name of the executable for the process. Logical disk is displayed in format \\device\\harddiskvolume\#. You can get all local volume numbers by using **diskpart** utility. The command to get volume numbers using diskpart is “**list volume”**: