diff --git a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md index d597eb2fe6..eaaf841ead 100644 --- a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md +++ b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md @@ -24,9 +24,7 @@ ms.technology: windows-sec - Windows 10 - Windows 11 -- Windows Server 2016 and up * - -* Not all events are available in Windows Server 2016 and up, e.g. (eg: 3099, 31xx). +- Windows Server 2016 and later (limited events) A Windows Defender Application Control (WDAC) policy logs events locally in Windows Event Viewer in either enforced or audit mode. These events are generated under two locations: