From f99460406c4cf7299ff0985057d081fc619b89ce Mon Sep 17 00:00:00 2001 From: Michael Nady Date: Tue, 17 May 2022 17:10:34 +0200 Subject: [PATCH] Update windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../event-id-explanations.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md index d597eb2fe6..eaaf841ead 100644 --- a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md +++ b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md @@ -24,9 +24,7 @@ ms.technology: windows-sec - Windows 10 - Windows 11 -- Windows Server 2016 and up * - -* Not all events are available in Windows Server 2016 and up, e.g. (eg: 3099, 31xx). +- Windows Server 2016 and later (limited events) A Windows Defender Application Control (WDAC) policy logs events locally in Windows Event Viewer in either enforced or audit mode. These events are generated under two locations: