Merge pull request #6719 from MicrosoftDocs/v-smandalika-5694287-B13

windows - v-smandalika- 5694287

windows/security/threat-protection/auditing/event-4913.md

@@ -77,13 +77,13 @@ This event always generates, regardless of the object’s [SACL](/windows/win32/
 
 **Subject:**
 
--   **Security ID** \[Type = SID\]**:** SID of account that changed the Central Access Policy on the object. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
+-   **Security ID** \[Type = SID\]**:** SID of account that changed the Central Access Policy on the object. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID can't be resolved, you'll see the source data in the event.
 
 > **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
 
 -   **Account Name** \[Type = UnicodeString\]**:** the name of the account that changed the Central Access Policy on the object.
 
--   **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following:
+-   **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following ones:
 
     -   Domain NETBIOS name example: CONTOSO
 
@@ -137,7 +137,7 @@ This event always generates, regardless of the object’s [SACL](/windows/win32/
 
 -   **Original Security Descriptor** \[Type = UnicodeString\]**:** the Security Descriptor Definition Language (SDDL) value for the old Central Policy ID (for the policy that was formerly applied to the object).
 
-    SDDL contains Central Access Policy SID, here is an example: S:ARAI(SP;ID;;;;S-1-17-1442530252-1178042555-1247349694-2318402534), Central Access Policy SID here is “**S-1-17-1442530252-1178042555-1247349694-2318402534**”. To resolve this SID to the real Central Access Policy name you need to do the following:
+    SDDL contains Central Access Policy SID, here's an example: S:ARAI(SP;ID;;;;S-1-17-1442530252-1178042555-1247349694-2318402534), Central Access Policy SID here is “**S-1-17-1442530252-1178042555-1247349694-2318402534**”. To resolve this SID to the real Central Access Policy name, you need to do the following steps:
 
 1.  Find Central Access Policy Active Directory object in: “CN=Central Access Policies,CN=Claims Configuration,CN=Services,CN=Configuration,DC=XXX,DC=XX” Active Directory container.
 
@@ -166,11 +166,11 @@ This event always generates, regardless of the object’s [SACL](/windows/win32/
 |-------|--------------------------------------|-------|---------------------------------|
 | "AO"  | Account operators                    | "PA"  | Group Policy administrators     |
 | "RU"  | Alias to allow previous Windows 2000 | "IU"  | Interactively logged-on user    |
-| "AN"  | Anonymous logon                      | "LA"  | Local administrator             |
+| "AN"  | Anonymous sign in                      | "LA"  | Local administrator             |
 | "AU"  | Authenticated users                  | "LG"  | Local guest                     |
 | "BA"  | Built-in administrators              | "LS"  | Local service account           |
 | "BG"  | Built-in guests                      | "SY"  | Local system                    |
-| "BO"  | Backup operators                     | "NU"  | Network logon user              |
+| "BO"  | Backup operators                     | "NU"  | Network sign-in user              |
 | "BU"  | Built-in users                       | "NO"  | Network configuration operators |
 | "CA"  | Certificate server administrators    | "NS"  | Network service account         |
 | "CG"  | Creator group                        | "PO"  | Printer operators               |
@@ -182,7 +182,7 @@ This event always generates, regardless of the object’s [SACL](/windows/win32/
 | "DU"  | Domain users                         | "RC"  | Restricted code                 |
 | "EA"  | Enterprise administrators            | "SA"  | Schema administrators           |
 | "ED"  | Enterprise domain controllers        | "SO"  | Server operators                |
-| "WD"  | Everyone                             | "SU"  | Service logon user              |
+| "WD"  | Everyone                             | "SU"  | Service sign-in user              |
 
 - *G*: = Primary Group.
 - *D*: = DACL Entries.
@@ -202,7 +202,7 @@ Example: D:(A;;FA;;;WD)
 
 "P” - SDDL\_PROTECTED, Inheritance from containers that are higher in the folder hierarchy are blocked.
 
-"AI" - SDDL\_AUTO\_INHERITED, Inheritance is allowed, assuming that "P" Is not also set.
+"AI" - SDDL\_AUTO\_INHERITED, Inheritance is allowed, assuming that "P" isn't also set.
 
 "AR" - SDDL\_AUTO\_INHERIT\_REQ, Child objects inherit permissions from this object.
 
@@ -228,7 +228,7 @@ Example: D:(A;;FA;;;WD)
 
 "CI" - CONTAINER INHERIT: Child objects that are containers, such as directories, inherit the ACE as an explicit ACE.
 
-"OI" - OBJECT INHERIT: Child objects that are not containers inherit the ACE as an explicit ACE.
+"OI" - OBJECT INHERIT: Child objects that aren't containers inherit the ACE as an explicit ACE.
 
 "NP" - NO PROPAGATE: only immediate children inherit this ace.
 
@@ -239,7 +239,7 @@ Example: D:(A;;FA;;;WD)
 "SA" - SUCCESSFUL ACCESS AUDIT
 
 "FA" - FAILED ACCESS AUDIT
-- rights: A hexadecimal string which denotes the access mask or reserved value, for example: FA (File All Access), FX (File Execute), FW (File Write), etc.
+- rights: A hexadecimal string that denotes the access mask or reserved value, for example: FA (File All Access), FX (File Execute), FW (File Write), etc.
 
 | Value                      | Description                     | Value                | Description              |
 |----------------------------|---------------------------------|----------------------|--------------------------|
@@ -261,7 +261,7 @@ Example: D:(A;;FA;;;WD)
 
 - object\_guid: N/A
 - inherit\_object\_guid: N/A
-- account\_sid: SID of specific security principal, or reserved value, for example: AN (Anonymous), WD (Everyone), SY (LOCAL\_SYSTEM), etc. See the table above for more details.
+- account\_sid: SID of specific security principal, or reserved value, for example: AN (Anonymous), WD (Everyone), SY (LOCAL\_SYSTEM), etc. For more information, see the table above.
 
 For more information about SDDL syntax, see these articles: <https://msdn.microsoft.com/library/cc230374.aspx>, <https://msdn.microsoft.com/library/windows/hardware/aa374892(v=vs.85).aspx>.
 
@@ -277,7 +277,7 @@ For 4913(S): Central Access Policy on the object was changed.
 
 -   If you have a pre-defined “**Process Name**” for the process reported in this event, monitor all events with “**Process Name**” not equal to your defined value.
 
--   You can monitor to see if “**Process Name**” is not in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**).
+-   You can monitor to see if “**Process Name**” isn't in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**).
 
 <!-- -->
 

windows/security/threat-protection/auditing/event-4928.md

@@ -97,12 +97,12 @@ Failure event generates if an error occurs (**Status Code** != 0).
 
     <img src="images/ad-sites-and-services.png" alt="Directory Replication Service options in AD Sites and Services" width="890" height="529" />
 
--   **Status Code** \[Type = UInt32\]**:** if there are no issues or errors, the status code will be 0. If an error happened, you will receive Failure event and Status Code will not be equal to “**0**”. You can check error code meaning here: <https://msdn.microsoft.com/library/windows/desktop/ms681381(v=vs.85).aspx>
+-   **Status Code** \[Type = UInt32\]**:** if there are no issues or errors, the status code will be 0. If an error happened, you'll receive Failure event and Status Code won't be equal to “**0**”. You can check error code meaning here: <https://msdn.microsoft.com/library/windows/desktop/ms681381(v=vs.85).aspx>
 
 ## Security Monitoring Recommendations
 
 For 4928(S, F): An Active Directory replica source naming context was established.
 
--   Monitor for **Source Address** field, because the source of new replication (new DRA) must be authorized for this action. If you find any unauthorized DRA you should trigger an event.
+-   Monitor for **Source Address** field, because the source of new replication (new DRA) must be authorized for this action. If you find any unauthorized DRA, you should trigger an event.
 
 -   This event is typically used for Active Directory replication troubleshooting.

windows/security/threat-protection/auditing/event-4929.md

@@ -89,18 +89,18 @@ Failure event generates if an error occurs (**Status Code** != 0).
 
 -   **Source Address** \[Type = UnicodeString\]: DNS record of the server from which the “remove” request was received.
 
--   **Naming Context** \[Type = UnicodeString\]**:** naming context which was removed.
+-   **Naming Context** \[Type = UnicodeString\]**:** naming context that was removed.
 
 > **Note**  The Directory Tree of Active Directory tree is partitioned to allow sections to be distributed (replicated) to domain controllers in different domains within the forest. Each domain controller stores a copy of a specific part of the directory tree, called a **Naming Context** also known as Directory Partition. **Naming Context** is replicated as a unit to other domain controllers in the forest that contain a replica of the same sub tree. A **Naming Context** is also called a Directory Partition.
 
 -   **Options** \[Type = UInt32\]: decimal value of [DRS Options](/openspecs/windows_protocols/ms-drsr/ac9c8a11-cd46-4080-acbf-9faa86344030).
 
--   **Status Code** \[Type = UInt32\]**:** if there are no issues or errors, the status code will be 0. If an error happened, you will receive Failure event and Status Code will not be equal to “**0**”. You can check error code meaning here: <https://msdn.microsoft.com/library/windows/desktop/ms681381(v=vs.85).aspx>
+-   **Status Code** \[Type = UInt32\]**:** if there are no issues or errors, the status code will be 0. If an error happened, you'll receive Failure event and Status Code won't be equal to “**0**”. You can check error code meaning here: <https://msdn.microsoft.com/library/windows/desktop/ms681381(v=vs.85).aspx>
 
 ## Security Monitoring Recommendations
 
 For 4929(S, F): An Active Directory replica source naming context was removed.
 
--   Monitor for **Source Address** field, because the source of the request must be authorized for this action. If you find any unauthorized DRA you should trigger an event.
+-   Monitor for **Source Address** field, because the source of the request must be authorized for this action. If you find any unauthorized DRA, you should trigger an event.
 
 -   This event is typically used for Active Directory replication troubleshooting.

windows/security/threat-protection/auditing/event-4930.md

@@ -27,7 +27,7 @@ This event generates every time Active Directory replica source naming context w
 
 Failure event generates if an error occurs (**Status Code** != 0).
 
-It is not possible to understand what exactly was modified from this event.
+It isn't possible to understand what exactly was modified from this event.
 
 > **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
 
@@ -91,18 +91,18 @@ It is not possible to understand what exactly was modified from this event.
 
 -   **Source Address** \[Type = UnicodeString\]: DNS record of computer from which the modification request was received.
 
--   **Naming Context** \[Type = UnicodeString\]**:** naming context which was modified.
+-   **Naming Context** \[Type = UnicodeString\]**:** naming context that was modified.
 
 > **Note**  The Directory Tree of Active Directory tree is partitioned to allow sections to be distributed (replicated) to domain controllers in different domains within the forest. Each domain controller stores a copy of a specific part of the directory tree, called a **Naming Context** also known as Directory Partition. **Naming Context** is replicated as a unit to other domain controllers in the forest that contain a replica of the same sub tree. A **Naming Context** is also called a Directory Partition.
 
 -   **Options** \[Type = UInt32\]: decimal value of [DRS Options](/openspecs/windows_protocols/ms-drsr/ac9c8a11-cd46-4080-acbf-9faa86344030).
 
--   **Status Code** \[Type = UInt32\]**:** if there are no issues or errors, the status code will be 0. If an error happened, you will receive Failure event and Status Code will not be equal to “**0**”. You can check error code meaning here: <https://msdn.microsoft.com/library/windows/desktop/ms681381(v=vs.85).aspx>
+-   **Status Code** \[Type = UInt32\]**:** if there are no issues or errors, the status code will be 0. If an error happened, you'll receive Failure event and Status Code won't be equal to “**0**”. You can check error code meaning here: <https://msdn.microsoft.com/library/windows/desktop/ms681381(v=vs.85).aspx>
 
 ## Security Monitoring Recommendations
 
 For 4930(S, F): An Active Directory replica source naming context was modified.
 
--   Monitor for **Source Address** field, because the source of the request must be authorized for this action. If you find any unauthorized DRA you should trigger an event.
+-   Monitor for **Source Address** field, because the source of the request must be authorized for this action. If you find any unauthorized DRA, you should trigger an event.
 
 -   This event is typically used for Active Directory replication troubleshooting.

windows/security/threat-protection/auditing/event-4931.md

@@ -27,7 +27,7 @@ This event generates every time Active Directory replica destination naming cont
 
 Failure event generates if an error occurs (**Status Code** != 0).
 
-It is not possible to understand what exactly was modified from this event.
+It isn't possible to understand what exactly was modified from this event.
 
 > **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
 
@@ -91,13 +91,13 @@ It is not possible to understand what exactly was modified from this event.
 
 -   **Destination Address** \[Type = UnicodeString\]: DNS record of computer to which the modification request was sent.
 
--   **Naming Context** \[Type = UnicodeString\]**:** naming context which was modified.
+-   **Naming Context** \[Type = UnicodeString\]**:** naming context that was modified.
 
 > **Note**  The Directory Tree of Active Directory tree is partitioned to allow sections to be distributed (replicated) to domain controllers in different domains within the forest. Each domain controller stores a copy of a specific part of the directory tree, called a **Naming Context** also known as Directory Partition. **Naming Context** is replicated as a unit to other domain controllers in the forest that contain a replica of the same sub tree. A **Naming Context** is also called a Directory Partition.
 
 -   **Options** \[Type = UInt32\]: decimal value of [DRS Options](/openspecs/windows_protocols/ms-drsr/ac9c8a11-cd46-4080-acbf-9faa86344030).
 
--   **Status Code** \[Type = UInt32\]**:** if there are no issues or errors, the status code will be 0. If an error happened, you will receive Failure event and Status Code will not be equal to “**0**”. You can check error code meaning here: <https://msdn.microsoft.com/library/windows/desktop/ms681381(v=vs.85).aspx>
+-   **Status Code** \[Type = UInt32\]**:** if there are no issues or errors, the status code will be 0. If an error happened, you'll receive Failure event and Status Code won't be equal to “**0**”. You can check error code meaning here: <https://msdn.microsoft.com/library/windows/desktop/ms681381(v=vs.85).aspx>
 
 ## Security Monitoring Recommendations
 

windows/security/threat-protection/auditing/event-4945.md

@@ -25,7 +25,7 @@ ms.technology: windows-sec
 
 This event generates every time Windows Firewall service starts.
 
-This event shows the inbound and/or outbound rule which was listed when the Windows Firewall started and applied for “Public” profile.
+This event shows the inbound and/or outbound rule that was listed when the Windows Firewall started and applied for “Public” profile.
 
 This event generates per rule.
 
@@ -75,11 +75,11 @@ This event generates per rule.
 
 -   **Rule ID** \[Type = UnicodeString\]: the unique firewall rule identifier.
 
-    To see the unique ID of the rule you need to navigate to “**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules”** registry key and you will see the list of Windows Firewall rule IDs (Name column) with parameters:
+    To see the unique ID of the rule, you need to navigate to “**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules”** registry key and you'll see the list of Windows Firewall rule IDs (Name column) with parameters:
 
 <img src="images/registry-editor-firewallrules.png" alt="Registry Editor FirewallRules key illustration" width="1412" height="422" />
 
--   **Rule Name** \[Type = UnicodeString\]: the name of the rule which was listed when the Windows Firewall started. You can see the name of Windows Firewall rule using Windows Firewall with Advanced Security management console (**wf.msc**), check “Name” column:
+-   **Rule Name** \[Type = UnicodeString\]: the name of the rule that was listed when the Windows Firewall started. You can see the name of Windows Firewall rule using Windows Firewall with Advanced Security management console (**wf.msc**), check “Name” column:
 
 <img src="images/windows-firewall-with-advanced-security.png" alt="Windows Firewall with Advanced Security illustration" width="1082" height="363" />
 
@@ -89,5 +89,5 @@ For 4945(S): A rule was listed when the Windows Firewall started.
 
 -   Typically this event has an informational purpose.
 
--   Unfortunately this event shows rules only for **Public** profile, but you still can compare this list with your organization's Windows Firewall baseline for Public profile rules on different computers, and trigger an alert if the configuration is not the same.
+-   Unfortunately this event shows rules only for **Public** profile, but you still can compare this list with your organization's Windows Firewall baseline for Public profile rules on different computers, and trigger an alert if the configuration isn't the same.
 

windows/security/threat-protection/auditing/event-4946.md

@@ -71,11 +71,11 @@ This event doesn't generate when new rule was added via Group Policy.
 
 -   All
 
--   Domain,Public
+-   Domain, Public
 
--   Domain,Private
+-   Domain, Private
 
--   Private,Public
+-   Private, Public
 
 -   Public
 
@@ -87,11 +87,11 @@ This event doesn't generate when new rule was added via Group Policy.
 
 -   **Rule ID** \[Type = UnicodeString\]: the unique new firewall rule identifier.
 
-    To see the unique ID of the rule you need to navigate to “**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules”** registry key and you will see the list of Windows Firewall rule IDs (Name column) with parameters:
+    To see the unique ID of the rule, you need to navigate to “**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules”** registry key and you'll see the list of Windows Firewall rule IDs (Name column) with parameters:
 
 <img src="images/registry-editor-firewallrules.png" alt="Registry Editor FirewallRules key illustration" width="1412" height="422" />
 
--   **Rule Name** \[Type = UnicodeString\]: the name of the rule which was added. You can see the name of Windows Firewall rule using Windows Firewall with Advanced Security management console (**wf.msc**), check “Name” column:
+-   **Rule Name** \[Type = UnicodeString\]: the name of the rule that was added. You can see the name of Windows Firewall rule using Windows Firewall with Advanced Security management console (**wf.msc**), check “Name” column:
 
 <img src="images/windows-firewall-with-advanced-security.png" alt="Windows Firewall with Advanced Security illustration" width="1082" height="363" />
 
@@ -99,5 +99,5 @@ This event doesn't generate when new rule was added via Group Policy.
 
 For 4946(S): A change has been made to Windows Firewall exception list. A rule was added.
 
--   This event can be helpful in case you want to monitor all creations of new Firewall rules which were done locally.
+-   This event can be helpful in case you want to monitor all creations of new Firewall rules that were done locally.
 

windows/security/threat-protection/auditing/event-4948.md

@@ -71,11 +71,11 @@ This event doesn't generate when the rule was deleted via Group Policy.
 
 -   All
 
--   Domain,Public
+-   Domain, Public
 
--   Domain,Private
+-   Domain, Private
 
--   Private,Public
+-   Private, Public
 
 -   Public
 
@@ -87,11 +87,11 @@ This event doesn't generate when the rule was deleted via Group Policy.
 
 -   **Rule ID** \[Type = UnicodeString\]: the unique identifier for deleted firewall rule.
 
-    To see the unique ID of the rule you need to navigate to “**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules”** registry key and you will see the list of Windows Firewall rule IDs (Name column) with parameters:
+    To see the unique ID of the rule, you need to navigate to “**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules”** registry key and you'll see the list of Windows Firewall rule IDs (Name column) with parameters:
 
 <img src="images/registry-editor-firewallrules.png" alt="Registry Editor FirewallRules key illustration" width="1412" height="422" />
 
--   **Rule Name** \[Type = UnicodeString\]: the name of the rule which was deleted. You can see the name of Windows Firewall rule using Windows Firewall with Advanced Security management console (**wf.msc**), check “Name” column:
+-   **Rule Name** \[Type = UnicodeString\]: the name of the rule that was deleted. You can see the name of Windows Firewall rule using Windows Firewall with Advanced Security management console (**wf.msc**), check “Name” column:
 
 <img src="images/windows-firewall-with-advanced-security.png" alt="Windows Firewall with Advanced Security illustration" width="1082" height="363" />
 
@@ -99,5 +99,5 @@ This event doesn't generate when the rule was deleted via Group Policy.
 
 For 4948(S): A change has been made to Windows Firewall exception list. A rule was deleted.
 
--   This event can be helpful in case you want to monitor all deletions of Firewall rules which were done locally.
+-   This event can be helpful in case you want to monitor all deletions of Firewall rules that were done locally.
 

windows/security/threat-protection/auditing/event-4950.md

@@ -77,7 +77,7 @@ This event doesn't generate when Windows Firewall setting was changed via Group
 
 **New Setting:**
 
--   **Type** \[Type = UnicodeString\]: the name of the setting which was modified. You can use “**netsh advfirewall**” command to see or set Windows Firewall settings, for example, to see settings for current\\active Windows Firewall profile you need to execute “**netsh advfirewall show currentprofile**” command:
+-   **Type** \[Type = UnicodeString\]: the name of the setting that was modified. You can use “**netsh advfirewall**” command to see or set Windows Firewall settings, for example, to see settings for current\\active Windows Firewall profile you need to execute “**netsh advfirewall show currentprofile**” command:
 
 <img src="images/netsh-advfirewall-command.png" alt="Netsh advfirewall command illustration" width="951" height="422" />
 
@@ -89,5 +89,5 @@ For 4950(S): A Windows Firewall setting has changed.
 
 -   If you have a standard or baseline for Windows Firewall settings defined, monitor this event and check whether the settings reported by the event are still the same as were defined in your standard or baseline.
 
--   This event can be helpful in case you want to monitor all changes in Windows Firewall settings which were done locally.
+-   This event can be helpful in case you want to monitor all changes in Windows Firewall settings that were done locally.
 

windows/security/threat-protection/auditing/event-4951.md

@@ -1,6 +1,6 @@
 ---
-title: 4951(F) A rule has been ignored because its major version number was not recognized by Windows Firewall. (Windows 10)
+title: 4951(F) A rule has been ignored because its major version number wasn't recognized by Windows Firewall. (Windows 10)
-description: Describes security event 4951(F) A rule has been ignored because its major version number was not recognized by Windows Firewall.
+description: Describes security event 4951(F) A rule has been ignored because its major version number wasn't recognized by Windows Firewall.
 ms.pagetype: security
 ms.prod: m365-security
 ms.mktglfcycl: deploy
@@ -14,7 +14,7 @@ ms.author: dansimp
 ms.technology: windows-sec
 ---
 
-# 4951(F): A rule has been ignored because its major version number was not recognized by Windows Firewall.
+# 4951(F): A rule has been ignored because its major version number wasn't recognized by Windows Firewall.
 
 
 <img src="images/event-4951.png" alt="Event 4951 illustration" width="449" height="364" hspace="10" align="left" />
@@ -25,7 +25,7 @@ ms.technology: windows-sec
 
 When you create or edit a Windows Firewall rule, the settings that you can include depend upon the version of Windows you use when creating the rule. As new settings are added to later versions of Windows or to service packs for existing versions of Windows, the version number of the rules processing engine is updated, and that version number is stamped into rules that are created by using that version of Windows. For example, Windows Vista produces firewall rules that are stamped with version "v2.0". Future versions of Windows might use "v2.1", or "v3.0" to indicate, respectively, minor or major changes and additions.
 
-If you create a firewall rule on a newer version of Windows that references firewall settings that are not available on earlier versions of Windows, and then try to deploy that rule to computers running the earlier version of Windows, the firewall engine produces this error to indicate that it cannot process the rule.
+If you create a firewall rule on a newer version of Windows that references firewall settings that aren't available on earlier versions of Windows, and then try to deploy that rule to computers running the earlier version of Windows, the firewall engine produces this error to indicate that it can't process the rule.
 
 The only solution is to remove the incompatible rule, and then deploy a compatible rule.
 
@@ -73,11 +73,11 @@ The only solution is to remove the incompatible rule, and then deploy a compatib
 
 -   All
 
--   Domain,Public
+-   Domain, Public
 
--   Domain,Private
+-   Domain, Private
 
--   Private,Public
+-   Private, Public
 
 -   Public
 
@@ -89,17 +89,17 @@ The only solution is to remove the incompatible rule, and then deploy a compatib
 
 -   **ID** \[Type = UnicodeString\]: the unique identifier for ignored firewall rule.
 
-    To see the unique ID of the rule you need to navigate to “**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules”** registry key and you will see the list of Windows Firewall rule IDs (Name column) with parameters:
+    To see the unique ID of the rule, you need to navigate to “**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules”** registry key and you'll see the list of Windows Firewall rule IDs (Name column) with parameters:
 
 <img src="images/registry-editor-firewallrules.png" alt="Registry Editor FirewallRules key illustration" width="1412" height="422" />
 
--   **Name** \[Type = UnicodeString\]: the name of the rule which was ignored. You can see the name of Windows Firewall rule using Windows Firewall with Advanced Security management console (**wf.msc**), check “Name” column:
+-   **Name** \[Type = UnicodeString\]: the name of the rule that was ignored. You can see the name of Windows Firewall rule using Windows Firewall with Advanced Security management console (**wf.msc**), check “Name” column:
 
 <img src="images/windows-firewall-with-advanced-security.png" alt="Windows Firewall with Advanced Security illustration" width="1082" height="363" />
 
 ## Security Monitoring Recommendations
 
-For 4951(F): A rule has been ignored because its major version number was not recognized by Windows Firewall.
+For 4951(F): A rule has been ignored because its major version number wasn't recognized by Windows Firewall.
 
 -   This event can be a sign of software issues, Windows Firewall registry errors or corruption, or Group Policy setting misconfigurations. We recommend monitoring this event and investigating the reason for the condition. Typically this event indicates configuration issues, not security issues.
 

windows/security/threat-protection/auditing/event-4953.md

@@ -1,6 +1,6 @@
 ---
-title: 4953(F) Windows Firewall ignored a rule because it could not be parsed. (Windows 10)
+title: 4953(F) Windows Firewall ignored a rule because it couldn't be parsed. (Windows 10)
-description: Describes security event 4953(F) Windows Firewall ignored a rule because it could not be parsed.
+description: Describes security event 4953(F) Windows Firewall ignored a rule because it couldn't be parsed.
 ms.pagetype: security
 ms.prod: m365-security
 ms.mktglfcycl: deploy
@@ -14,7 +14,7 @@ ms.author: dansimp
 ms.technology: windows-sec
 ---
 
-# 4953(F): Windows Firewall ignored a rule because it could not be parsed.
+# 4953(F): Windows Firewall ignored a rule because it couldn't be parsed.
 
 
 <img src="images/event-4953.png" alt="Event 4953 illustration" width="449" height="375" hspace="10" align="left" />
@@ -23,7 +23,7 @@ ms.technology: windows-sec
 
 ***Event Description:***
 
-This event generates if Windows Firewall was not able to parse Windows Firewall rule for some reason.
+This event generates if Windows Firewall wasn't able to parse Windows Firewall rule for some reason.
 
 It can happen if Windows Firewall rule registry entry was corrupted.
 
@@ -72,11 +72,11 @@ It can happen if Windows Firewall rule registry entry was corrupted.
 
 -   All
 
--   Domain,Public
+-   Domain, Public
 
--   Domain,Private
+-   Domain, Private
 
--   Private,Public
+-   Private, Public
 
 -   Public
 
@@ -90,7 +90,7 @@ It can happen if Windows Firewall rule registry entry was corrupted.
 
 -   **ID** \[Type = UnicodeString\]: the unique identifier for ignored firewall rule.
 
-    To see the unique ID of the rule, navigate to the “**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules”** registry key and you will see the list of Windows Firewall rule IDs (Name column) with parameters:
+    To see the unique ID of the rule, navigate to the “**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules”** registry key and you'll see the list of Windows Firewall rule IDs (Name column) with parameters:
 
 <img src="images/registry-editor-firewallrules.png" alt="Registry Editor FirewallRules key illustration" width="1412" height="422" />
 
@@ -100,7 +100,7 @@ It can happen if Windows Firewall rule registry entry was corrupted.
 
 ## Security Monitoring Recommendations
 
-For 4953(F): Windows Firewall ignored a rule because it could not be parsed.
+For 4953(F): Windows Firewall ignored a rule because it couldn't be parsed.
 
 -   This event can be a sign of software issues, Windows Firewall registry errors or corruption, or Group Policy setting misconfigurations. We recommend monitoring this event and investigating the reason for the condition. Typically this event indicates configuration issues, not security issues.
 

windows/security/threat-protection/auditing/event-4957.md

@@ -1,6 +1,6 @@
 ---
 title: 4957(F) Windows Firewall did not apply the following rule. (Windows 10)
-description: Describes security event 4957(F) Windows Firewall did not apply the following rule.
+description: Describes security event 4957(F) Windows Firewall didn't apply the following rule.
 ms.pagetype: security
 ms.prod: m365-security
 ms.mktglfcycl: deploy
@@ -23,7 +23,7 @@ ms.technology: windows-sec
 
 ***Event Description:***
 
-This event generates when Windows Firewall starts or apply new rule, and the rule cannot be applied for some reason.
+This event generates when Windows Firewall starts or apply new rule, and the rule can't be applied for some reason.
 
 > **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
 
@@ -69,17 +69,17 @@ This event generates when Windows Firewall starts or apply new rule, and the rul
 
 -   **ID** \[Type = UnicodeString\]: the unique identifier for not applied firewall rule.
 
-    To see the unique ID of the rule you need to navigate to “**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules”** registry key and you will see the list of Windows Firewall rule IDs (Name column) with parameters:
+    To see the unique ID of the rule, you need to navigate to “**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules”** registry key and you'll see the list of Windows Firewall rule IDs (Name column) with parameters:
 
 <img src="images/registry-editor-firewallrules.png" alt="Registry Editor FirewallRules key illustration" width="1412" height="422" />
 
--   **Name** \[Type = UnicodeString\]: the name of the rule which was not applied. You can see the name of Windows Firewall rule using Windows Firewall with Advanced Security management console (**wf.msc**), check “Name” column:
+-   **Name** \[Type = UnicodeString\]: the name of the rule that wasn't applied. You can see the name of Windows Firewall rule using Windows Firewall with Advanced Security management console (**wf.msc**), check “Name” column:
 
 <img src="images/windows-firewall-with-advanced-security.png" alt="Windows Firewall with Advanced Security illustration" width="1082" height="363" />
 
 **Error Information:**
 
--   **Reason** \[Type = UnicodeString\]: the reason why the rule was not applied.
+-   **Reason** \[Type = UnicodeString\]: the reason why the rule wasn't applied.
 
 ## Security Monitoring Recommendations
 

windows/security/threat-protection/auditing/event-4958.md

@@ -1,6 +1,6 @@
 ---
 title: 4958(F) Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer. (Windows 10)
-description: Describes security event 4958(F) Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer.
+description: Describes security event 4958(F) Windows Firewall didn't apply the following rule because the rule referred to items not configured on this computer.
 ms.pagetype: security
 ms.prod: m365-security
 ms.mktglfcycl: deploy
@@ -17,15 +17,15 @@ ms.technology: windows-sec
 # 4958(F): Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer.
 
 
-Windows Firewall with Advanced Security processed a rule that contains parameters that cannot be resolved on the local computer. The rule is therefore not enforceable on the computer and so is excluded from the runtime state of the firewall. This is not necessarily an error. Examine the rule for applicability on the computers to which it was applied.
+Windows Firewall with Advanced Security processed a rule that contains parameters that can't be resolved on the local computer. The rule is therefore not enforceable on the computer and so is excluded from the runtime state of the firewall. This exclusion isn't necessarily an error. Examine the rule for applicability on the computers to which it was applied.
 
-There is no example of this event in this document.
+There's no example of this event in this document.
 
 ***Subcategory:*** [Audit MPSSVC Rule-Level Policy Change](audit-mpssvc-rule-level-policy-change.md)
 
 ***Event Schema:***
 
-*Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer:
+*Windows Firewall didn't apply the following rule because the rule referred to items not configured on this computer:
 Rule Information:
 %tID:%t%1
 %tName:%t%2

windows/security/threat-protection/auditing/event-5030.md

@@ -19,9 +19,9 @@ ms.technology: windows-sec
 
 Windows logs this event if the Windows Firewall service fails to start, or if it unexpectedly terminates. The error message indicates the cause of the service failure by including an error code in the text of the message.
 
-This event doesn't generate during Windows Firewall service failures if Windows Firewall policy is incorrect\\corrupted or one of the service dependencies was not started.
+This event doesn't generate during Windows Firewall service failures if Windows Firewall policy is incorrect\\corrupted or one of the service dependencies wasn't started.
 
-There is no example of this event in this document.
+There's no example of this event in this document.
 
 ***Subcategory:*** [Audit Other System Events](audit-other-system-events.md)
 

windows/security/threat-protection/auditing/event-5031.md

@@ -25,7 +25,7 @@ ms.technology: windows-sec
 
 This event generates when an application was blocked from accepting incoming connections on the network by [Windows Filtering Platform](/windows/win32/fwp/windows-filtering-platform-start-page).
 
-If you don’t have any firewall rules (Allow or Deny) in Windows Firewall for specific applications, you will get this event from [Windows Filtering Platform](/windows/win32/fwp/windows-filtering-platform-start-page) layer, because by default this layer is denying any incoming connections.
+If you don’t have any firewall rules (Allow or Deny) in Windows Firewall for specific applications, you'll get this event from [Windows Filtering Platform](/windows/win32/fwp/windows-filtering-platform-start-page) layer, because by default this layer is denying any incoming connections.
 
 > **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
 
@@ -82,8 +82,8 @@ For 5031(F): The Windows Firewall Service blocked an application from accepting
 
 -   You can use this event to detect applications for which no Windows Firewall rules were created.
 
--   If you have a pre-defined application which should be used to perform the operation that was reported by this event, monitor events with “**Application**” not equal to your defined application.
+-   If you have a pre-defined application that should be used to perform the operation that was reported by this event, monitor events with “**Application**” not equal to your defined application.
 
--   You can monitor to see if “**Application**” is not in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**).
+-   You can monitor to see if “**Application**” isn't in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**).
 
 -   If you have a pre-defined list of restricted substrings or words in application names (for example, “**mimikatz**” or “**cain.exe**”), check for these substrings in “**Application**.”

windows/security/threat-protection/auditing/event-5038.md

@@ -1,6 +1,6 @@
 ---
 title: 5038(F) Code integrity determined that the image hash of a file is not valid. (Windows 10)
-description: Describes security event 5038(F) Code integrity determined that the image hash of a file is not valid.
+description: Describes security event 5038(F) Code integrity determined that the image hash of a file isn't valid.
 ms.pagetype: security
 ms.prod: m365-security
 ms.mktglfcycl: deploy
@@ -19,11 +19,11 @@ ms.technology: windows-sec
 
 The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.
 
-This event generates by [Code Integrity](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd348642(v=ws.10)) feature, if signature of a file is not valid.
+This event generates by [Code Integrity](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd348642(v=ws.10)) feature, if signature of a file isn't valid.
 
-Code Integrity is a feature that improves the security of the operating system by validating the integrity of a driver or system file each time it is loaded into memory. Code Integrity detects whether an unsigned driver or system file is being loaded into the kernel, or whether a system file has been modified by malicious software that is being run by a user account with administrative permissions. On x64-based versions of the operating system, kernel-mode drivers must be digitally signed.
+Code Integrity is a feature that improves the security of the operating system by validating the integrity of a driver or system file each time it's loaded into memory. Code Integrity detects whether an unsigned driver or system file is being loaded into the kernel, or whether a system file has been modified by malicious software that is being run by a user account with administrative permissions. On x64-based versions of the operating system, kernel-mode drivers must be digitally signed.
 
-There is no example of this event in this document.
+There's no example of this event in this document.
 
 ***Subcategory:*** [Audit System Integrity](audit-system-integrity.md)
 

windows/security/threat-protection/auditing/event-5039.md

@@ -19,9 +19,9 @@ ms.technology: windows-sec
 
 This event should be generated when registry key was virtualized using [LUAFV](https://blogs.msdn.com/b/alexcarp/archive/2009/06/25/the-deal-with-luafv-sys.aspx).
 
-This event occurs very rarely during standard LUAFV registry key virtualization.
+This event occurs rarely during standard LUAFV registry key virtualization.
 
-There is no example of this event in this document.
+There's no example of this event in this document.
 
 ***Subcategory:*** [Audit Registry](audit-registry.md)
 
@@ -59,7 +59,7 @@ There is no example of this event in this document.
 
 ## Security Monitoring Recommendations
 
--   There is no recommendation for this event in this document.
+-   There's no recommendation for this event in this document.
 
 
 

windows/security/threat-protection/auditing/event-5051.md

@@ -19,9 +19,9 @@ ms.technology: windows-sec
 
 This event should be generated when file was virtualized using [LUAFV](https://blogs.msdn.com/b/alexcarp/archive/2009/06/25/the-deal-with-luafv-sys.aspx).
 
-This event occurs very rarely during standard LUAFV file virtualization.
+This event occurs rarely during standard LUAFV file virtualization.
 
-There is no example of this event in this document.
+There's no example of this event in this document.
 
 ***Subcategory:*** [Audit File System](audit-file-system.md)
 
@@ -59,5 +59,5 @@ There is no example of this event in this document.
 
 ## Security Monitoring Recommendations
 
--   There is no recommendation for this event in this document.
+-   There's no recommendation for this event in this document.
 

windows/security/threat-protection/auditing/event-5056.md

@@ -27,9 +27,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
 
 -   <https://www.microsoft.com/download/details.aspx?id=30688>
 
-This event is mainly used for CNG troubleshooting.
+This event is used for CNG troubleshooting.
 
-There is no example of this event in this document.
+There's no example of this event in this document.
 
 ***Subcategory:***&nbsp;[Audit System Integrity](audit-system-integrity.md)
 

windows/security/threat-protection/auditing/event-5057.md

@@ -17,7 +17,7 @@ ms.technology: windows-sec
 # 5057(F): A cryptographic primitive operation failed.
 
 
-This event generates in case of CNG primitive operation failure.
+This event generates if there's a CNG primitive operation failure.
 
 For more information about Cryptographic Next Generation (CNG) visit these pages:
 
@@ -27,9 +27,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
 
 -   <https://www.microsoft.com/download/details.aspx?id=30688>
 
-This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.
+This event is used for Cryptographic Next Generation (CNG) troubleshooting.
 
-There is no example of this event in this document.
+There's no example of this event in this document.
 
 ***Subcategory:***&nbsp;[Audit System Integrity](audit-system-integrity.md)
 

windows/security/threat-protection/auditing/event-5058.md

@@ -23,7 +23,7 @@ ms.technology: windows-sec
 
 ***Event Description:***
 
-This event generates when an operation (read, write, delete, and so on) was performed on a file that contains a KSP key by using a [Key Storage Provider](/windows/win32/seccertenroll/cng-key-storage-providers) (KSP). This event generates only if one of the following KSPs were used:
+This event generates when an operation (read, write, delete, and so on) was performed on a file that contains a KSP key by using a [Key Storage Provider](/windows/win32/seccertenroll/cng-key-storage-providers) (KSP). This event generates only if one of the following KSPs was used:
 
 -   Microsoft Software Key Storage Provider
 
@@ -81,13 +81,13 @@ You can see these events, for example, during certificate renewal or export oper
 
 **Subject:**
 
--   **Security ID** \[Type = SID\]**:** SID of account that requested key file operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
+-   **Security ID** \[Type = SID\]**:** SID of account that requested key file operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID can't be resolved, you'll see the source data in the event.
 
 > **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
 
 -   **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested key file operation.
 
--   **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following:
+-   **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following ones:
 
     -   Domain NETBIOS name example: CONTOSO
 
@@ -109,7 +109,7 @@ You can see these events, for example, during certificate renewal or export oper
 
     -   Microsoft Smart Card Key Storage Provider
 
--   **Algorithm Name** \[Type = UnicodeString\]: the name of cryptographic algorithm through which the key was used or accessed. For “Read persisted key from file” operation, this typically has “**UNKNOWN**” value. Can also have one of the following values:
+-   **Algorithm Name** \[Type = UnicodeString\]: the name of cryptographic algorithm through which the key was used or accessed. For “Read persisted key from file” operation, this algorithm has “**UNKNOWN**” value. Can also have one of the following values:
 
     -   RSA – algorithm created by Ron Rivest, Adi Shamir, and Leonard Adleman.
 
@@ -129,7 +129,7 @@ You can see these events, for example, during certificate renewal or export oper
 
     -   ECDSA\_P521 – Elliptic Curve Digital Signature Algorithm with 521-bit key length.
 
--   **Key Name** \[Type = UnicodeString\]: the name of the key (key container) with which operation was performed. For example, to get the list of **Key Names** for certificates for logged in user you can use “**certutil -store -user my**” command and check **Key Container** parameter in the output. Here is an output example:
+-   **Key Name** \[Type = UnicodeString\]: the name of the key (key container) with which operation was performed. For example, to get the list of **Key Names** for certificates for logged in user you can use “**certutil -store -user my**” command and check **Key Container** parameter in the output. Here's an output example:
 
 <img src="images/certutil-command.png" alt="Certutil command illustration" width="588" height="665" />
 

windows/security/threat-protection/auditing/event-5060.md

@@ -27,9 +27,9 @@ For more information about CNG, visit these pages:
 
 -   <https://www.microsoft.com/download/details.aspx?id=30688>
 
-This event is mainly used for CNG troubleshooting.
+This event is used for CNG troubleshooting.
 
-There is no example of this event in this document.
+There's no example of this event in this document.
 
 ***Subcategory:***&nbsp;[Audit System Integrity](audit-system-integrity.md)
 

windows/security/threat-protection/auditing/event-5061.md

@@ -23,7 +23,7 @@ ms.technology: windows-sec
 
 ***Event Description:***
 
-This event generates when a cryptographic operation (open key, create key, create key, and so on) was performed using a [Key Storage Provider](/windows/win32/seccertenroll/cng-key-storage-providers) (KSP). This event generates only if one of the following KSPs were used:
+This event generates when a cryptographic operation (open key, create key, create key, and so on) was performed using a [Key Storage Provider](/windows/win32/seccertenroll/cng-key-storage-providers) (KSP). This event generates only if one of the following KSPs was used:
 
 -   Microsoft Software Key Storage Provider
 
@@ -78,13 +78,13 @@ This event generates when a cryptographic operation (open key, create key, creat
 
 **Subject:**
 
--   **Security ID** \[Type = SID\]**:** SID of account that requested specific cryptographic operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
+-   **Security ID** \[Type = SID\]**:** SID of account that requested specific cryptographic operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID can't be resolved, you'll see the source data in the event.
 
 > **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
 
 -   **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested specific cryptographic operation.
 
--   **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following:
+-   **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following ones:
 
     -   Domain NETBIOS name example: CONTOSO
 
@@ -106,7 +106,7 @@ This event generates when a cryptographic operation (open key, create key, creat
 
     -   Microsoft Smart Card Key Storage Provider
 
--   **Algorithm Name** \[Type = UnicodeString\]: the name of cryptographic algorithm through which the key was used or accessed. For “Read persisted key from file” operation, this typically has “**UNKNOWN**” value. Can also have one of the following values:
+-   **Algorithm Name** \[Type = UnicodeString\]: the name of cryptographic algorithm through which the key was used or accessed. For “Read persisted key from file” operation, this algorithm has “**UNKNOWN**” value. Can also have one of the following values:
 
     -   RSA – algorithm created by Ron Rivest, Adi Shamir, and Leonard Adleman.
 
@@ -126,7 +126,7 @@ This event generates when a cryptographic operation (open key, create key, creat
 
     -   ECDSA\_P521 – Elliptic Curve Digital Signature Algorithm with 521-bit key length.
 
--   **Key Name** \[Type = UnicodeString\]: the name of the key (key container) with which operation was performed. For example, to get the list of **Key Names** for certificates for logged in user you can use “**certutil -store -user my**” command and check **Key Container** parameter in the output. Here is an output example:
+-   **Key Name** \[Type = UnicodeString\]: the name of the key (key container) with which operation was performed. For example, to get the list of **Key Names** for certificates for logged in user you can use “**certutil -store -user my**” command and check **Key Container** parameter in the output. Here's an output example:
 
 <img src="images/certutil-command.png" alt="Certutil command illustration" width="588" height="665" />
 

windows/security/threat-protection/auditing/event-5063.md

@@ -17,7 +17,7 @@ ms.technology: windows-sec
 # 5063(S, F): A cryptographic provider operation was attempted.
 
 
-This event generates in BCryptUnregisterProvider() and BCryptRegisterProvider() functions. These are Cryptographic Next Generation (CNG) functions.
+This event generates in BCryptUnregisterProvider() and BCryptRegisterProvider() functions. These functions are Cryptographic Next Generation (CNG) functions.
 
 This event generates when cryptographic provider was registered or unregistered.
 
@@ -27,9 +27,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
 
 -   <https://www.microsoft.com/download/details.aspx?id=30688>
 
-This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.
+This event is used for Cryptographic Next Generation (CNG) troubleshooting.
 
-There is no example of this event in this document.
+There's no example of this event in this document.
 
 ***Subcategory:***&nbsp;[Audit Other Policy Change Events](audit-other-policy-change-events.md)
 

windows/security/threat-protection/auditing/event-5064.md

@@ -17,7 +17,7 @@ ms.technology: windows-sec
 # 5064(S, F): A cryptographic context operation was attempted.
 
 
-This event generates in [BCryptCreateContext](/windows/win32/api/bcrypt/nf-bcrypt-bcryptcreatecontext)() and [BCryptDeleteContext](/windows/win32/api/bcrypt/nf-bcrypt-bcryptdeletecontext)() functions. These are Cryptographic Next Generation (CNG) functions.
+This event generates in [BCryptCreateContext](/windows/win32/api/bcrypt/nf-bcrypt-bcryptcreatecontext)() and [BCryptDeleteContext](/windows/win32/api/bcrypt/nf-bcrypt-bcryptdeletecontext)() functions. These functions are Cryptographic Next Generation (CNG) functions.
 
 This event generates when cryptographic context was created or deleted.
 
@@ -27,9 +27,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
 
 -   <https://www.microsoft.com/download/details.aspx?id=30688>
 
-This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.
+This event is used for Cryptographic Next Generation (CNG) troubleshooting.
 
-There is no example of this event in this document.
+There's no example of this event in this document.
 
 ***Subcategory:***&nbsp;[Audit Other Policy Change Events](audit-other-policy-change-events.md)
 

windows/security/threat-protection/auditing/event-5065.md

@@ -16,8 +16,7 @@ ms.technology: windows-sec
 
 # 5065(S, F): A cryptographic context modification was attempted.
 
-
+This event generates in [BCryptConfigureContext](/windows/win32/api/bcrypt/nf-bcrypt-bcryptconfigurecontext)() function. This function is a Cryptographic Next Generation (CNG) function.
-This event generates in [BCryptConfigureContext](/windows/win32/api/bcrypt/nf-bcrypt-bcryptconfigurecontext)() function. This is a Cryptographic Next Generation (CNG) function.
 
 This event generates when configuration information was changed for existing CNG context.
 
@@ -27,9 +26,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
 
 -   <https://www.microsoft.com/download/details.aspx?id=30688>
 
-This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.
+This event is used for Cryptographic Next Generation (CNG) troubleshooting.
 
-There is no example of this event in this document.
+There's no example of this event in this document.
 
 ***Subcategory:***&nbsp;[Audit Other Policy Change Events](audit-other-policy-change-events.md)
 

windows/security/threat-protection/auditing/event-5066.md

@@ -17,7 +17,7 @@ ms.technology: windows-sec
 # 5066(S, F): A cryptographic function operation was attempted.
 
 
-This event generates in [BCryptAddContextFunction](/windows/win32/api/bcrypt/nf-bcrypt-bcryptaddcontextfunction)() and [BCryptRemoveContextFunction](/windows/win32/api/bcrypt/nf-bcrypt-bcryptremovecontextfunction)() functions. These are Cryptographic Next Generation (CNG) functions.
+This event generates in [BCryptAddContextFunction](/windows/win32/api/bcrypt/nf-bcrypt-bcryptaddcontextfunction)() and [BCryptRemoveContextFunction](/windows/win32/api/bcrypt/nf-bcrypt-bcryptremovecontextfunction)() functions. These functions are Cryptographic Next Generation (CNG) functions.
 
 This event generates when cryptographic function was added or removed from the list of functions that are supported by an existing CNG context.
 
@@ -27,9 +27,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
 
 -   <https://www.microsoft.com/download/details.aspx?id=30688>
 
-This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.
+This event is used for Cryptographic Next Generation (CNG) troubleshooting.
 
-There is no example of this event in this document.
+There's no example of this event in this document.
 
 ***Subcategory:***&nbsp;[Audit Other Policy Change Events](audit-other-policy-change-events.md)
 

windows/security/threat-protection/auditing/event-5067.md

@@ -17,19 +17,19 @@ ms.technology: windows-sec
 # 5067(S, F): A cryptographic function modification was attempted.
 
 
-This event generates in [BCryptConfigureContextFunction](/windows/win32/api/bcrypt/nf-bcrypt-bcryptconfigurecontextfunction)() function. This is a Cryptographic Next Generation (CNG) function.
+This event generates in [BCryptConfigureContextFunction](/windows/win32/api/bcrypt/nf-bcrypt-bcryptconfigurecontextfunction)() function. This function is a Cryptographic Next Generation (CNG) function.
 
 This event generates when configuration information for the cryptographic function of an existing CNG context was changed.
 
-For more information about Cryptographic Next Generation (CNG) visit these pages:
+For more information about Cryptographic Next Generation (CNG), visit these pages:
 
 -   <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx>
 
 -   <https://www.microsoft.com/download/details.aspx?id=30688>
 
-This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.
+This event is used for Cryptographic Next Generation (CNG) troubleshooting.
 
-There is no example of this event in this document.
+There's no example of this event in this document.
 
 ***Subcategory:***&nbsp;[Audit Other Policy Change Events](audit-other-policy-change-events.md)
 

windows/security/threat-protection/auditing/event-5068.md

@@ -17,17 +17,17 @@ ms.technology: windows-sec
 # 5068(S, F): A cryptographic function provider operation was attempted.
 
 
-This event generates in BCryptAddContextFunctionProvider() and BCryptRemoveContextFunctionProvider() functions. These are Cryptographic Next Generation (CNG) functions.
+This event generates in BCryptAddContextFunctionProvider() and BCryptRemoveContextFunctionProvider() functions. These functions are Cryptographic Next Generation (CNG) functions.
 
-For more information about Cryptographic Next Generation (CNG) visit these pages:
+For more information about Cryptographic Next Generation (CNG), visit these pages:
 
 -   <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx>
 
 -   <https://www.microsoft.com/download/details.aspx?id=30688>
 
-This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.
+This event is used for Cryptographic Next Generation (CNG) troubleshooting.
 
-There is no example of this event in this document.
+There's no example of this event in this document.
 
 ***Subcategory:***&nbsp;[Audit Other Policy Change Events](audit-other-policy-change-events.md)
 

windows/security/threat-protection/auditing/event-5069.md

@@ -17,19 +17,19 @@ ms.technology: windows-sec
 # 5069(S, F): A cryptographic function property operation was attempted.
 
 
-This event generates in [BCryptSetContextFunctionProperty](/windows/win32/api/bcrypt/nf-bcrypt-bcryptsetcontextfunctionproperty)() function. This is a Cryptographic Next Generation (CNG) function.
+This event generates in [BCryptSetContextFunctionProperty](/windows/win32/api/bcrypt/nf-bcrypt-bcryptsetcontextfunctionproperty)() function. This function is a Cryptographic Next Generation (CNG) function.
 
 This event generates when named property for a cryptographic function in an existing CNG context was added or removed.
 
-For more information about Cryptographic Next Generation (CNG) visit these pages:
+For more information about Cryptographic Next Generation (CNG), visit these pages:
 
 -   <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx>
 
 -   <https://www.microsoft.com/download/details.aspx?id=30688>
 
-This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.
+This event is used for Cryptographic Next Generation (CNG) troubleshooting.
 
-There is no example of this event in this document.
+There's no example of this event in this document.
 
 ***Subcategory:***&nbsp;[Audit Other Policy Change Events](audit-other-policy-change-events.md)