From fe6a326f63839fbafc4acaced54dcc4efbcfd839 Mon Sep 17 00:00:00 2001
From: Justin Hall <Justinha@microsoft.com>
Date: Thu, 1 Feb 2018 10:06:00 -0800
Subject: [PATCH] moved auditing files

---
 .openpublishing.redirection.json              | 840 ++++++++++++++++++
 ...advanced-security-audit-policy-settings.md |   0
 .../advanced-security-auditing-faq.md         |   0
 .../auditing/advanced-security-auditing.md    |   0
 ...g-recommendations-for-many-audit-events.md |   0
 ...-basic-audit-policy-on-a-file-or-folder.md |   0
 .../auditing/audit-account-lockout.md         |   0
 .../auditing/audit-application-generated.md   |   0
 .../audit-application-group-management.md     |   0
 .../auditing/audit-audit-policy-change.md     |   0
 .../audit-authentication-policy-change.md     |   0
 .../audit-authorization-policy-change.md      |   0
 .../audit-central-access-policy-staging.md    |   0
 .../auditing/audit-certification-services.md  |   0
 .../audit-computer-account-management.md      |   0
 .../auditing/audit-credential-validation.md   |   0
 ...-detailed-directory-service-replication.md |   0
 .../auditing/audit-detailed-file-share.md     |   0
 .../audit-directory-service-access.md         |   0
 .../audit-directory-service-changes.md        |   0
 .../audit-directory-service-replication.md    |   0
 .../audit-distribution-group-management.md    |   0
 .../auditing/audit-dpapi-activity.md          |   0
 .../auditing/audit-file-share.md              |   0
 .../auditing/audit-file-system.md             |   0
 .../audit-filtering-platform-connection.md    |   0
 .../audit-filtering-platform-packet-drop.md   |   0
 .../audit-filtering-platform-policy-change.md |   0
 .../auditing/audit-group-membership.md        |   0
 .../auditing/audit-handle-manipulation.md     |   0
 .../auditing/audit-ipsec-driver.md            |   0
 .../auditing/audit-ipsec-extended-mode.md     |   0
 .../auditing/audit-ipsec-main-mode.md         |   0
 .../auditing/audit-ipsec-quick-mode.md        |   0
 .../audit-kerberos-authentication-service.md  |   0
 ...udit-kerberos-service-ticket-operations.md |   0
 .../auditing/audit-kernel-object.md           |   0
 .../auditing/audit-logoff.md                  |   0
 .../auditing/audit-logon.md                   |   0
 .../audit-mpssvc-rule-level-policy-change.md  |   0
 .../auditing/audit-network-policy-server.md   |   0
 .../audit-non-sensitive-privilege-use.md      |   0
 .../audit-other-account-logon-events.md       |   0
 .../audit-other-account-management-events.md  |   0
 .../audit-other-logonlogoff-events.md         |   0
 .../audit-other-object-access-events.md       |   0
 .../audit-other-policy-change-events.md       |   0
 .../audit-other-privilege-use-events.md       |   0
 .../auditing/audit-other-system-events.md     |   0
 .../auditing/audit-pnp-activity.md            |   0
 .../auditing/audit-process-creation.md        |   0
 .../auditing/audit-process-termination.md     |   0
 .../auditing/audit-registry.md                |   0
 .../auditing/audit-removable-storage.md       |   0
 .../auditing/audit-rpc-events.md              |   0
 .../threat-protection}/auditing/audit-sam.md  |   0
 .../audit-security-group-management.md        |   0
 .../auditing/audit-security-state-change.md   |   0
 .../audit-security-system-extension.md        |   0
 .../auditing/audit-sensitive-privilege-use.md |   0
 .../auditing/audit-special-logon.md           |   0
 .../auditing/audit-system-integrity.md        |   0
 .../auditing/audit-user-account-management.md |   0
 .../auditing/audit-user-device-claims.md      |   0
 .../basic-audit-account-logon-events.md       |   0
 .../basic-audit-account-management.md         |   0
 .../basic-audit-directory-service-access.md   |   0
 .../auditing/basic-audit-logon-events.md      |   0
 .../auditing/basic-audit-object-access.md     |   0
 .../auditing/basic-audit-policy-change.md     |   0
 .../auditing/basic-audit-privilege-use.md     |   0
 .../auditing/basic-audit-process-tracking.md  |   0
 .../auditing/basic-audit-system-events.md     |   0
 .../auditing/basic-security-audit-policies.md |   0
 .../basic-security-audit-policy-settings.md   |   0
 ...t-policy-settings-for-an-event-category.md |   0
 .../threat-protection}/auditing/event-1100.md |   0
 .../threat-protection}/auditing/event-1102.md |   0
 .../threat-protection}/auditing/event-1104.md |   0
 .../threat-protection}/auditing/event-1105.md |   0
 .../threat-protection}/auditing/event-1108.md |   0
 .../threat-protection}/auditing/event-4608.md |   0
 .../threat-protection}/auditing/event-4610.md |   0
 .../threat-protection}/auditing/event-4611.md |   0
 .../threat-protection}/auditing/event-4612.md |   0
 .../threat-protection}/auditing/event-4614.md |   0
 .../threat-protection}/auditing/event-4615.md |   0
 .../threat-protection}/auditing/event-4616.md |   0
 .../threat-protection}/auditing/event-4618.md |   0
 .../threat-protection}/auditing/event-4621.md |   0
 .../threat-protection}/auditing/event-4622.md |   0
 .../threat-protection}/auditing/event-4624.md |   0
 .../threat-protection}/auditing/event-4625.md |   0
 .../threat-protection}/auditing/event-4626.md |   0
 .../threat-protection}/auditing/event-4627.md |   0
 .../threat-protection}/auditing/event-4634.md |   0
 .../threat-protection}/auditing/event-4647.md |   0
 .../threat-protection}/auditing/event-4648.md |   0
 .../threat-protection}/auditing/event-4649.md |   0
 .../threat-protection}/auditing/event-4656.md |   0
 .../threat-protection}/auditing/event-4657.md |   0
 .../threat-protection}/auditing/event-4658.md |   0
 .../threat-protection}/auditing/event-4660.md |   0
 .../threat-protection}/auditing/event-4661.md |   0
 .../threat-protection}/auditing/event-4662.md |   0
 .../threat-protection}/auditing/event-4663.md |   0
 .../threat-protection}/auditing/event-4664.md |   0
 .../threat-protection}/auditing/event-4670.md |   0
 .../threat-protection}/auditing/event-4671.md |   0
 .../threat-protection}/auditing/event-4672.md |   0
 .../threat-protection}/auditing/event-4673.md |   0
 .../threat-protection}/auditing/event-4674.md |   0
 .../threat-protection}/auditing/event-4675.md |   0
 .../threat-protection}/auditing/event-4688.md |   0
 .../threat-protection}/auditing/event-4689.md |   0
 .../threat-protection}/auditing/event-4690.md |   0
 .../threat-protection}/auditing/event-4691.md |   0
 .../threat-protection}/auditing/event-4692.md |   0
 .../threat-protection}/auditing/event-4693.md |   0
 .../threat-protection}/auditing/event-4694.md |   0
 .../threat-protection}/auditing/event-4695.md |   0
 .../threat-protection}/auditing/event-4696.md |   0
 .../threat-protection}/auditing/event-4697.md |   0
 .../threat-protection}/auditing/event-4698.md |   0
 .../threat-protection}/auditing/event-4699.md |   0
 .../threat-protection}/auditing/event-4700.md |   0
 .../threat-protection}/auditing/event-4701.md |   0
 .../threat-protection}/auditing/event-4702.md |   0
 .../threat-protection}/auditing/event-4703.md |   0
 .../threat-protection}/auditing/event-4704.md |   0
 .../threat-protection}/auditing/event-4705.md |   0
 .../threat-protection}/auditing/event-4706.md |   0
 .../threat-protection}/auditing/event-4707.md |   0
 .../threat-protection}/auditing/event-4713.md |   0
 .../threat-protection}/auditing/event-4714.md |   0
 .../threat-protection}/auditing/event-4715.md |   0
 .../threat-protection}/auditing/event-4716.md |   0
 .../threat-protection}/auditing/event-4717.md |   0
 .../threat-protection}/auditing/event-4718.md |   0
 .../threat-protection}/auditing/event-4719.md |   0
 .../threat-protection}/auditing/event-4720.md |   0
 .../threat-protection}/auditing/event-4722.md |   0
 .../threat-protection}/auditing/event-4723.md |   0
 .../threat-protection}/auditing/event-4724.md |   0
 .../threat-protection}/auditing/event-4725.md |   0
 .../threat-protection}/auditing/event-4726.md |   0
 .../threat-protection}/auditing/event-4731.md |   0
 .../threat-protection}/auditing/event-4732.md |   0
 .../threat-protection}/auditing/event-4733.md |   0
 .../threat-protection}/auditing/event-4734.md |   0
 .../threat-protection}/auditing/event-4735.md |   0
 .../threat-protection}/auditing/event-4738.md |   0
 .../threat-protection}/auditing/event-4739.md |   0
 .../threat-protection}/auditing/event-4740.md |   0
 .../threat-protection}/auditing/event-4741.md |   0
 .../threat-protection}/auditing/event-4742.md |   0
 .../threat-protection}/auditing/event-4743.md |   0
 .../threat-protection}/auditing/event-4749.md |   0
 .../threat-protection}/auditing/event-4750.md |   0
 .../threat-protection}/auditing/event-4751.md |   0
 .../threat-protection}/auditing/event-4752.md |   0
 .../threat-protection}/auditing/event-4753.md |   0
 .../threat-protection}/auditing/event-4764.md |   0
 .../threat-protection}/auditing/event-4765.md |   0
 .../threat-protection}/auditing/event-4766.md |   0
 .../threat-protection}/auditing/event-4767.md |   0
 .../threat-protection}/auditing/event-4768.md |   0
 .../threat-protection}/auditing/event-4769.md |   0
 .../threat-protection}/auditing/event-4770.md |   0
 .../threat-protection}/auditing/event-4771.md |   0
 .../threat-protection}/auditing/event-4772.md |   0
 .../threat-protection}/auditing/event-4773.md |   0
 .../threat-protection}/auditing/event-4774.md |   0
 .../threat-protection}/auditing/event-4775.md |   0
 .../threat-protection}/auditing/event-4776.md |   0
 .../threat-protection}/auditing/event-4777.md |   0
 .../threat-protection}/auditing/event-4778.md |   0
 .../threat-protection}/auditing/event-4779.md |   0
 .../threat-protection}/auditing/event-4780.md |   0
 .../threat-protection}/auditing/event-4781.md |   0
 .../threat-protection}/auditing/event-4782.md |   0
 .../threat-protection}/auditing/event-4793.md |   0
 .../threat-protection}/auditing/event-4794.md |   0
 .../threat-protection}/auditing/event-4798.md |   0
 .../threat-protection}/auditing/event-4799.md |   0
 .../threat-protection}/auditing/event-4800.md |   0
 .../threat-protection}/auditing/event-4801.md |   0
 .../threat-protection}/auditing/event-4802.md |   0
 .../threat-protection}/auditing/event-4803.md |   0
 .../threat-protection}/auditing/event-4816.md |   0
 .../threat-protection}/auditing/event-4817.md |   0
 .../threat-protection}/auditing/event-4818.md |   0
 .../threat-protection}/auditing/event-4819.md |   0
 .../threat-protection}/auditing/event-4826.md |   0
 .../threat-protection}/auditing/event-4864.md |   0
 .../threat-protection}/auditing/event-4865.md |   0
 .../threat-protection}/auditing/event-4866.md |   0
 .../threat-protection}/auditing/event-4867.md |   0
 .../threat-protection}/auditing/event-4902.md |   0
 .../threat-protection}/auditing/event-4904.md |   0
 .../threat-protection}/auditing/event-4905.md |   0
 .../threat-protection}/auditing/event-4906.md |   0
 .../threat-protection}/auditing/event-4907.md |   0
 .../threat-protection}/auditing/event-4908.md |   0
 .../threat-protection}/auditing/event-4909.md |   0
 .../threat-protection}/auditing/event-4910.md |   0
 .../threat-protection}/auditing/event-4911.md |   0
 .../threat-protection}/auditing/event-4912.md |   0
 .../threat-protection}/auditing/event-4913.md |   0
 .../threat-protection}/auditing/event-4928.md |   0
 .../threat-protection}/auditing/event-4929.md |   0
 .../threat-protection}/auditing/event-4930.md |   0
 .../threat-protection}/auditing/event-4931.md |   0
 .../threat-protection}/auditing/event-4932.md |   0
 .../threat-protection}/auditing/event-4933.md |   0
 .../threat-protection}/auditing/event-4934.md |   0
 .../threat-protection}/auditing/event-4935.md |   0
 .../threat-protection}/auditing/event-4936.md |   0
 .../threat-protection}/auditing/event-4937.md |   0
 .../threat-protection}/auditing/event-4944.md |   0
 .../threat-protection}/auditing/event-4945.md |   0
 .../threat-protection}/auditing/event-4946.md |   0
 .../threat-protection}/auditing/event-4947.md |   0
 .../threat-protection}/auditing/event-4948.md |   0
 .../threat-protection}/auditing/event-4949.md |   0
 .../threat-protection}/auditing/event-4950.md |   0
 .../threat-protection}/auditing/event-4951.md |   0
 .../threat-protection}/auditing/event-4952.md |   0
 .../threat-protection}/auditing/event-4953.md |   0
 .../threat-protection}/auditing/event-4954.md |   0
 .../threat-protection}/auditing/event-4956.md |   0
 .../threat-protection}/auditing/event-4957.md |   0
 .../threat-protection}/auditing/event-4958.md |   0
 .../threat-protection}/auditing/event-4964.md |   0
 .../threat-protection}/auditing/event-4985.md |   0
 .../threat-protection}/auditing/event-5024.md |   0
 .../threat-protection}/auditing/event-5025.md |   0
 .../threat-protection}/auditing/event-5027.md |   0
 .../threat-protection}/auditing/event-5028.md |   0
 .../threat-protection}/auditing/event-5029.md |   0
 .../threat-protection}/auditing/event-5030.md |   0
 .../threat-protection}/auditing/event-5031.md |   0
 .../threat-protection}/auditing/event-5032.md |   0
 .../threat-protection}/auditing/event-5033.md |   0
 .../threat-protection}/auditing/event-5034.md |   0
 .../threat-protection}/auditing/event-5035.md |   0
 .../threat-protection}/auditing/event-5037.md |   0
 .../threat-protection}/auditing/event-5038.md |   0
 .../threat-protection}/auditing/event-5039.md |   0
 .../threat-protection}/auditing/event-5051.md |   0
 .../threat-protection}/auditing/event-5056.md |   0
 .../threat-protection}/auditing/event-5057.md |   0
 .../threat-protection}/auditing/event-5058.md |   0
 .../threat-protection}/auditing/event-5059.md |   0
 .../threat-protection}/auditing/event-5060.md |   0
 .../threat-protection}/auditing/event-5061.md |   0
 .../threat-protection}/auditing/event-5062.md |   0
 .../threat-protection}/auditing/event-5063.md |   0
 .../threat-protection}/auditing/event-5064.md |   0
 .../threat-protection}/auditing/event-5065.md |   0
 .../threat-protection}/auditing/event-5066.md |   0
 .../threat-protection}/auditing/event-5067.md |   0
 .../threat-protection}/auditing/event-5068.md |   0
 .../threat-protection}/auditing/event-5069.md |   0
 .../threat-protection}/auditing/event-5070.md |   0
 .../threat-protection}/auditing/event-5136.md |   0
 .../threat-protection}/auditing/event-5137.md |   0
 .../threat-protection}/auditing/event-5138.md |   0
 .../threat-protection}/auditing/event-5139.md |   0
 .../threat-protection}/auditing/event-5140.md |   0
 .../threat-protection}/auditing/event-5141.md |   0
 .../threat-protection}/auditing/event-5142.md |   0
 .../threat-protection}/auditing/event-5143.md |   0
 .../threat-protection}/auditing/event-5144.md |   0
 .../threat-protection}/auditing/event-5145.md |   0
 .../threat-protection}/auditing/event-5148.md |   0
 .../threat-protection}/auditing/event-5149.md |   0
 .../threat-protection}/auditing/event-5150.md |   0
 .../threat-protection}/auditing/event-5151.md |   0
 .../threat-protection}/auditing/event-5152.md |   0
 .../threat-protection}/auditing/event-5153.md |   0
 .../threat-protection}/auditing/event-5154.md |   0
 .../threat-protection}/auditing/event-5155.md |   0
 .../threat-protection}/auditing/event-5156.md |   0
 .../threat-protection}/auditing/event-5157.md |   0
 .../threat-protection}/auditing/event-5158.md |   0
 .../threat-protection}/auditing/event-5159.md |   0
 .../threat-protection}/auditing/event-5168.md |   0
 .../threat-protection}/auditing/event-5376.md |   0
 .../threat-protection}/auditing/event-5377.md |   0
 .../threat-protection}/auditing/event-5378.md |   0
 .../threat-protection}/auditing/event-5447.md |   0
 .../threat-protection}/auditing/event-5632.md |   0
 .../threat-protection}/auditing/event-5633.md |   0
 .../threat-protection}/auditing/event-5712.md |   0
 .../threat-protection}/auditing/event-5888.md |   0
 .../threat-protection}/auditing/event-5889.md |   0
 .../threat-protection}/auditing/event-5890.md |   0
 .../threat-protection}/auditing/event-6144.md |   0
 .../threat-protection}/auditing/event-6145.md |   0
 .../threat-protection}/auditing/event-6281.md |   0
 .../threat-protection}/auditing/event-6400.md |   0
 .../threat-protection}/auditing/event-6401.md |   0
 .../threat-protection}/auditing/event-6402.md |   0
 .../threat-protection}/auditing/event-6403.md |   0
 .../threat-protection}/auditing/event-6404.md |   0
 .../threat-protection}/auditing/event-6405.md |   0
 .../threat-protection}/auditing/event-6406.md |   0
 .../threat-protection}/auditing/event-6407.md |   0
 .../threat-protection}/auditing/event-6408.md |   0
 .../threat-protection}/auditing/event-6409.md |   0
 .../threat-protection}/auditing/event-6410.md |   0
 .../threat-protection}/auditing/event-6416.md |   0
 .../threat-protection}/auditing/event-6419.md |   0
 .../threat-protection}/auditing/event-6420.md |   0
 .../threat-protection}/auditing/event-6421.md |   0
 .../threat-protection}/auditing/event-6422.md |   0
 .../threat-protection}/auditing/event-6423.md |   0
 .../threat-protection}/auditing/event-6424.md |   0
 ...le-system-global-object-access-auditing.md |   0
 .../auditing/images/ad-sites-and-services.png | Bin
 .../auditing/images/advanced-sharing.png      | Bin
 .../images/auditpol-list-subcategory.png      | Bin
 .../auditing/images/auditpol-list-user.png    | Bin
 .../images/branchcache-properties.png         | Bin
 .../auditing/images/certutil-command.png      | Bin
 .../auditing/images/computer-management.png   | Bin
 .../auditing/images/diskpart.png              | Bin
 .../auditing/images/event-1100.png            | Bin
 .../auditing/images/event-1102.png            | Bin
 .../auditing/images/event-1104.png            | Bin
 .../auditing/images/event-1105.png            | Bin
 .../auditing/images/event-1108.png            | Bin
 .../auditing/images/event-4608.png            | Bin
 .../auditing/images/event-4610.png            | Bin
 .../auditing/images/event-4611.png            | Bin
 .../auditing/images/event-4614.png            | Bin
 .../auditing/images/event-4616.png            | Bin
 .../auditing/images/event-4618.png            | Bin
 .../auditing/images/event-4622.png            | Bin
 .../auditing/images/event-4624.png            | Bin
 .../auditing/images/event-4625.png            | Bin
 .../auditing/images/event-4626.png            | Bin
 .../auditing/images/event-4627.png            | Bin
 .../auditing/images/event-4634.png            | Bin
 .../auditing/images/event-4647.png            | Bin
 .../auditing/images/event-4648.png            | Bin
 .../auditing/images/event-4656.png            | Bin
 .../auditing/images/event-4657.png            | Bin
 .../auditing/images/event-4658.png            | Bin
 .../auditing/images/event-4660.png            | Bin
 .../auditing/images/event-4661.png            | Bin
 .../auditing/images/event-4662.png            | Bin
 .../auditing/images/event-4663.png            | Bin
 .../auditing/images/event-4664.png            | Bin
 .../auditing/images/event-4670.png            | Bin
 .../auditing/images/event-4672.png            | Bin
 .../auditing/images/event-4673.png            | Bin
 .../auditing/images/event-4674.png            | Bin
 .../auditing/images/event-4688.png            | Bin
 .../auditing/images/event-4689.png            | Bin
 .../auditing/images/event-4690.png            | Bin
 .../auditing/images/event-4691.png            | Bin
 .../auditing/images/event-4692.png            | Bin
 .../auditing/images/event-4693.png            | Bin
 .../auditing/images/event-4696.png            | Bin
 .../auditing/images/event-4697.png            | Bin
 .../auditing/images/event-4698.png            | Bin
 .../auditing/images/event-4699.png            | Bin
 .../auditing/images/event-4700.png            | Bin
 .../auditing/images/event-4701.png            | Bin
 .../auditing/images/event-4702.png            | Bin
 .../auditing/images/event-4703-partial.png    | Bin
 .../auditing/images/event-4703.png            | Bin
 .../auditing/images/event-4704.png            | Bin
 .../auditing/images/event-4705.png            | Bin
 .../auditing/images/event-4706.png            | Bin
 .../auditing/images/event-4707.png            | Bin
 .../auditing/images/event-4713.png            | Bin
 .../auditing/images/event-4714.png            | Bin
 .../auditing/images/event-4715.png            | Bin
 .../auditing/images/event-4716.png            | Bin
 .../auditing/images/event-4717.png            | Bin
 .../auditing/images/event-4718.png            | Bin
 .../auditing/images/event-4719.png            | Bin
 .../auditing/images/event-4720.png            | Bin
 .../auditing/images/event-4722.png            | Bin
 .../auditing/images/event-4723.png            | Bin
 .../auditing/images/event-4724.png            | Bin
 .../auditing/images/event-4725.png            | Bin
 .../auditing/images/event-4726.png            | Bin
 .../auditing/images/event-4731.png            | Bin
 .../auditing/images/event-4732.png            | Bin
 .../auditing/images/event-4733.png            | Bin
 .../auditing/images/event-4734.png            | Bin
 .../auditing/images/event-4735.png            | Bin
 .../auditing/images/event-4738.png            | Bin
 .../auditing/images/event-4739.png            | Bin
 .../auditing/images/event-4740.png            | Bin
 .../auditing/images/event-4741.png            | Bin
 .../auditing/images/event-4742.png            | Bin
 .../auditing/images/event-4743.png            | Bin
 .../auditing/images/event-4749.png            | Bin
 .../auditing/images/event-4750.png            | Bin
 .../auditing/images/event-4751.png            | Bin
 .../auditing/images/event-4752.png            | Bin
 .../auditing/images/event-4753.png            | Bin
 .../auditing/images/event-4764.png            | Bin
 .../auditing/images/event-4767.png            | Bin
 .../auditing/images/event-4768.png            | Bin
 .../auditing/images/event-4769.png            | Bin
 .../auditing/images/event-4770.png            | Bin
 .../auditing/images/event-4771.png            | Bin
 .../auditing/images/event-4776.png            | Bin
 .../auditing/images/event-4778.png            | Bin
 .../auditing/images/event-4779.png            | Bin
 .../auditing/images/event-4781.png            | Bin
 .../auditing/images/event-4782.png            | Bin
 .../auditing/images/event-4793.png            | Bin
 .../auditing/images/event-4794.png            | Bin
 .../auditing/images/event-4798.png            | Bin
 .../auditing/images/event-4799.png            | Bin
 .../auditing/images/event-4800.png            | Bin
 .../auditing/images/event-4801.png            | Bin
 .../auditing/images/event-4802.png            | Bin
 .../auditing/images/event-4803.png            | Bin
 .../auditing/images/event-4817.png            | Bin
 .../auditing/images/event-4818.png            | Bin
 .../auditing/images/event-4819.png            | Bin
 .../auditing/images/event-4826.png            | Bin
 .../auditing/images/event-4865.png            | Bin
 .../auditing/images/event-4866.png            | Bin
 .../auditing/images/event-4867.png            | Bin
 .../auditing/images/event-4902.png            | Bin
 .../auditing/images/event-4904.png            | Bin
 .../auditing/images/event-4905.png            | Bin
 .../auditing/images/event-4906.png            | Bin
 .../auditing/images/event-4907.png            | Bin
 .../auditing/images/event-4908.png            | Bin
 .../auditing/images/event-4911.png            | Bin
 .../auditing/images/event-4912.png            | Bin
 .../auditing/images/event-4913.png            | Bin
 .../auditing/images/event-4928.png            | Bin
 .../auditing/images/event-4929.png            | Bin
 .../auditing/images/event-4930.png            | Bin
 .../auditing/images/event-4931.png            | Bin
 .../auditing/images/event-4932.png            | Bin
 .../auditing/images/event-4933.png            | Bin
 .../auditing/images/event-4935.png            | Bin
 .../auditing/images/event-4944.png            | Bin
 .../auditing/images/event-4945.png            | Bin
 .../auditing/images/event-4946.png            | Bin
 .../auditing/images/event-4947.png            | Bin
 .../auditing/images/event-4948.png            | Bin
 .../auditing/images/event-4949.png            | Bin
 .../auditing/images/event-4950.png            | Bin
 .../auditing/images/event-4951.png            | Bin
 .../auditing/images/event-4953.png            | Bin
 .../auditing/images/event-4954.png            | Bin
 .../auditing/images/event-4956.png            | Bin
 .../auditing/images/event-4957.png            | Bin
 .../auditing/images/event-4964.png            | Bin
 .../auditing/images/event-4985.png            | Bin
 .../auditing/images/event-5024.png            | Bin
 .../auditing/images/event-5025.png            | Bin
 .../auditing/images/event-5027.png            | Bin
 .../auditing/images/event-5028.png            | Bin
 .../auditing/images/event-5031.png            | Bin
 .../auditing/images/event-5033.png            | Bin
 .../auditing/images/event-5034.png            | Bin
 .../auditing/images/event-5058.png            | Bin
 .../auditing/images/event-5059.png            | Bin
 .../auditing/images/event-5061.png            | Bin
 .../auditing/images/event-5136.png            | Bin
 .../auditing/images/event-5137.png            | Bin
 .../auditing/images/event-5138.png            | Bin
 .../auditing/images/event-5139.png            | Bin
 .../auditing/images/event-5140.png            | Bin
 .../auditing/images/event-5141.png            | Bin
 .../auditing/images/event-5142.png            | Bin
 .../auditing/images/event-5143.png            | Bin
 .../auditing/images/event-5144.png            | Bin
 .../auditing/images/event-5145.png            | Bin
 .../auditing/images/event-5152.png            | Bin
 .../auditing/images/event-5154.png            | Bin
 .../auditing/images/event-5156.png            | Bin
 .../auditing/images/event-5157.png            | Bin
 .../auditing/images/event-5158.png            | Bin
 .../auditing/images/event-5168.png            | Bin
 .../auditing/images/event-5376.png            | Bin
 .../auditing/images/event-5377.png            | Bin
 .../auditing/images/event-5378.png            | Bin
 .../auditing/images/event-5447.png            | Bin
 .../auditing/images/event-5632.png            | Bin
 .../auditing/images/event-5633.png            | Bin
 .../auditing/images/event-5888.png            | Bin
 .../auditing/images/event-5889.png            | Bin
 .../auditing/images/event-5890.png            | Bin
 .../auditing/images/event-6144.png            | Bin
 .../auditing/images/event-6145.png            | Bin
 .../auditing/images/event-6416.png            | Bin
 .../auditing/images/event-6419.png            | Bin
 .../auditing/images/event-6420.png            | Bin
 .../auditing/images/event-6421.png            | Bin
 .../auditing/images/event-6422.png            | Bin
 .../auditing/images/event-6423.png            | Bin
 .../auditing/images/filters-xml-file.png      | Bin
 .../firewall-settings-public-profile.png      | Bin
 .../auditing/images/group-policy-editor.png   | Bin
 .../auditing/images/group-policy.png          | Bin
 .../auditing/images/impact-property.png       | Bin
 .../auditing/images/ipconfig-command.png      | Bin
 .../logging-settings-public-profile.png       | Bin
 .../auditing/images/msb.png                   | Bin
 .../images/netsh-advfirewall-command.png      | Bin
 .../auditing/images/netsh-command.png         | Bin
 .../auditing/images/netsh-lan-command.png     | Bin
 .../auditing/images/offline-settings.png      | Bin
 .../auditing/images/query-session.png         | Bin
 .../auditing/images/registry-editor-audit.png | Bin
 .../images/registry-editor-firewallrules.png  | Bin
 .../auditing/images/schema-search.png         | Bin
 .../images/subkeys-under-security-key.png     | Bin
 .../auditing/images/subtree-deletion.png      | Bin
 .../auditing/images/synaptics.png             | Bin
 .../auditing/images/synaptics1.png            | Bin
 .../auditing/images/synaptics2.png            | Bin
 .../auditing/images/synaptics3.png            | Bin
 .../auditing/images/synaptics4.png            | Bin
 .../auditing/images/synaptics5.png            | Bin
 .../auditing/images/synaptics6.png            | Bin
 .../auditing/images/synaptics7.png            | Bin
 .../auditing/images/task-manager.png          | Bin
 .../auditing/images/wfpstate-xml.png          | Bin
 .../auditing/images/whoami-privilege-list.png | Bin
 .../images/windows-firewall-state-off.png     | Bin
 ...indows-firewall-with-advanced-security.png | Bin
 .../images/windows-powershell-get-gpo.png     | Bin
 ...tral-access-policy-and-rule-definitions.md |   0
 .../auditing/monitor-claim-types.md           |   0
 .../monitor-resource-attribute-definitions.md |   0
 ...icies-associated-with-files-and-folders.md |   0
 ...ss-policies-that-apply-on-a-file-server.md |   0
 ...esource-attributes-on-files-and-folders.md |   0
 ...or-the-use-of-removable-storage-devices.md |   0
 ...r-user-and-device-claims-during-sign-in.md |   0
 .../auditing/other-events.md                  |   0
 ...loying-advanced-security-audit-policies.md |   0
 .../registry-global-object-access-auditing.md |   0
 .../auditing/security-auditing-overview.md    |   0
 ...-monitor-dynamic-access-control-objects.md |   0
 .../auditing/view-the-security-event-log.md   |   0
 ...ort-advanced-audit-policy-configuration.md |   0
 553 files changed, 840 insertions(+)
 rename windows/{device-security => security/threat-protection}/auditing/advanced-security-audit-policy-settings.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/advanced-security-auditing-faq.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/advanced-security-auditing.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-account-lockout.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-application-generated.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-application-group-management.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-audit-policy-change.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-authentication-policy-change.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-authorization-policy-change.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-central-access-policy-staging.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-certification-services.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-computer-account-management.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-credential-validation.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-detailed-directory-service-replication.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-detailed-file-share.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-directory-service-access.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-directory-service-changes.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-directory-service-replication.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-distribution-group-management.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-dpapi-activity.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-file-share.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-file-system.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-filtering-platform-connection.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-filtering-platform-packet-drop.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-filtering-platform-policy-change.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-group-membership.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-handle-manipulation.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-ipsec-driver.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-ipsec-extended-mode.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-ipsec-main-mode.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-ipsec-quick-mode.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-kerberos-authentication-service.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-kerberos-service-ticket-operations.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-kernel-object.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-logoff.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-logon.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-mpssvc-rule-level-policy-change.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-network-policy-server.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-non-sensitive-privilege-use.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-other-account-logon-events.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-other-account-management-events.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-other-logonlogoff-events.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-other-object-access-events.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-other-policy-change-events.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-other-privilege-use-events.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-other-system-events.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-pnp-activity.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-process-creation.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-process-termination.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-registry.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-removable-storage.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-rpc-events.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-sam.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-security-group-management.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-security-state-change.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-security-system-extension.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-sensitive-privilege-use.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-special-logon.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-system-integrity.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-user-account-management.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/audit-user-device-claims.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/basic-audit-account-logon-events.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/basic-audit-account-management.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/basic-audit-directory-service-access.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/basic-audit-logon-events.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/basic-audit-object-access.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/basic-audit-policy-change.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/basic-audit-privilege-use.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/basic-audit-process-tracking.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/basic-audit-system-events.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/basic-security-audit-policies.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/basic-security-audit-policy-settings.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-1100.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-1102.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-1104.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-1105.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-1108.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4608.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4610.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4611.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4612.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4614.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4615.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4616.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4618.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4621.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4622.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4624.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4625.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4626.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4627.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4634.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4647.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4648.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4649.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4656.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4657.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4658.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4660.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4661.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4662.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4663.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4664.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4670.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4671.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4672.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4673.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4674.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4675.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4688.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4689.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4690.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4691.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4692.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4693.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4694.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4695.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4696.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4697.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4698.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4699.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4700.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4701.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4702.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4703.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4704.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4705.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4706.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4707.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4713.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4714.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4715.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4716.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4717.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4718.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4719.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4720.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4722.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4723.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4724.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4725.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4726.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4731.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4732.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4733.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4734.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4735.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4738.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4739.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4740.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4741.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4742.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4743.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4749.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4750.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4751.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4752.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4753.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4764.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4765.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4766.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4767.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4768.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4769.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4770.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4771.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4772.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4773.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4774.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4775.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4776.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4777.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4778.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4779.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4780.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4781.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4782.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4793.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4794.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4798.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4799.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4800.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4801.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4802.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4803.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4816.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4817.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4818.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4819.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4826.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4864.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4865.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4866.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4867.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4902.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4904.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4905.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4906.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4907.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4908.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4909.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4910.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4911.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4912.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4913.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4928.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4929.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4930.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4931.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4932.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4933.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4934.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4935.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4936.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4937.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4944.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4945.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4946.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4947.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4948.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4949.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4950.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4951.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4952.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4953.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4954.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4956.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4957.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4958.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4964.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-4985.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5024.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5025.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5027.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5028.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5029.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5030.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5031.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5032.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5033.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5034.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5035.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5037.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5038.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5039.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5051.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5056.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5057.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5058.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5059.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5060.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5061.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5062.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5063.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5064.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5065.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5066.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5067.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5068.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5069.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5070.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5136.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5137.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5138.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5139.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5140.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5141.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5142.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5143.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5144.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5145.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5148.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5149.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5150.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5151.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5152.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5153.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5154.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5155.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5156.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5157.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5158.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5159.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5168.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5376.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5377.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5378.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5447.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5632.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5633.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5712.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5888.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5889.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-5890.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6144.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6145.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6281.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6400.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6401.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6402.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6403.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6404.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6405.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6406.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6407.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6408.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6409.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6410.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6416.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6419.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6420.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6421.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6422.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6423.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/event-6424.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/file-system-global-object-access-auditing.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/ad-sites-and-services.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/advanced-sharing.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/auditpol-list-subcategory.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/auditpol-list-user.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/branchcache-properties.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/certutil-command.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/computer-management.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/diskpart.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-1100.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-1102.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-1104.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-1105.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-1108.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4608.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4610.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4611.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4614.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4616.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4618.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4622.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4624.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4625.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4626.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4627.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4634.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4647.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4648.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4656.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4657.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4658.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4660.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4661.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4662.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4663.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4664.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4670.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4672.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4673.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4674.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4688.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4689.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4690.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4691.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4692.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4693.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4696.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4697.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4698.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4699.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4700.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4701.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4702.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4703-partial.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4703.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4704.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4705.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4706.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4707.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4713.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4714.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4715.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4716.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4717.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4718.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4719.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4720.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4722.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4723.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4724.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4725.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4726.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4731.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4732.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4733.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4734.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4735.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4738.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4739.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4740.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4741.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4742.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4743.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4749.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4750.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4751.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4752.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4753.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4764.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4767.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4768.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4769.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4770.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4771.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4776.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4778.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4779.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4781.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4782.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4793.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4794.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4798.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4799.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4800.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4801.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4802.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4803.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4817.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4818.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4819.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4826.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4865.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4866.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4867.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4902.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4904.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4905.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4906.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4907.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4908.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4911.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4912.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4913.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4928.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4929.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4930.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4931.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4932.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4933.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4935.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4944.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4945.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4946.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4947.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4948.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4949.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4950.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4951.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4953.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4954.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4956.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4957.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4964.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-4985.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5024.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5025.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5027.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5028.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5031.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5033.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5034.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5058.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5059.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5061.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5136.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5137.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5138.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5139.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5140.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5141.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5142.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5143.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5144.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5145.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5152.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5154.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5156.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5157.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5158.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5168.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5376.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5377.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5378.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5447.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5632.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5633.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5888.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5889.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-5890.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-6144.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-6145.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-6416.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-6419.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-6420.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-6421.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-6422.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/event-6423.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/filters-xml-file.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/firewall-settings-public-profile.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/group-policy-editor.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/group-policy.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/impact-property.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/ipconfig-command.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/logging-settings-public-profile.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/msb.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/netsh-advfirewall-command.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/netsh-command.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/netsh-lan-command.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/offline-settings.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/query-session.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/registry-editor-audit.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/registry-editor-firewallrules.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/schema-search.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/subkeys-under-security-key.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/subtree-deletion.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/synaptics.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/synaptics1.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/synaptics2.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/synaptics3.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/synaptics4.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/synaptics5.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/synaptics6.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/synaptics7.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/task-manager.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/wfpstate-xml.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/whoami-privilege-list.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/windows-firewall-state-off.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/windows-firewall-with-advanced-security.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/images/windows-powershell-get-gpo.png (100%)
 rename windows/{device-security => security/threat-protection}/auditing/monitor-central-access-policy-and-rule-definitions.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/monitor-claim-types.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/monitor-resource-attribute-definitions.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/monitor-the-resource-attributes-on-files-and-folders.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/monitor-the-use-of-removable-storage-devices.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/monitor-user-and-device-claims-during-sign-in.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/other-events.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/planning-and-deploying-advanced-security-audit-policies.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/registry-global-object-access-auditing.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/security-auditing-overview.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/view-the-security-event-log.md (100%)
 rename windows/{device-security => security/threat-protection}/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md (100%)

diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json
index 420009de7f..3bf6973e3f 100644
--- a/.openpublishing.redirection.json
+++ b/.openpublishing.redirection.json
@@ -1,6 +1,846 @@
 {
 "redirections": [
 {
+"source_path": "windows/device-security/auditing/advanced-security-audit-policy-settings.md",
+"redirect_url": "/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/advanced-security-auditing-faq.md",
+"redirect_url": "/windows/security/threat-protection/auditing/advanced-security-auditing.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md",
+"redirect_url": "/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-account-lockout.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-application-generated.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-application-group-management.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-audit-policy-change.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-authentication-policy-change.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-authorization-policy-change.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-central-access-policy-staging.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-certification-services.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-computer-account-management.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-credential-validation.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-detailed-directory-service-replication.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-detailed-file-share.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-directory-service-access.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-directory-service-changes.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-directory-service-replication.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-distribution-group-management.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-dpapi-activity.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-file-share.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-file-system.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-filtering-platform-packet-drop.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-group-membership.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-handle-manipulation.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-ipsec-driver.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-ipsec-main-mode.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-kerberos-authentication-service.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-kernel-object.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-logoff.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-logon.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-network-policy-server.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-other-account-logon-events.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-other-account-management-events.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-other-logonlogoff-events.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-other-object-access-events.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-other-policy-change-events.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-other-system-events.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-pnp-activity.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-process-creation.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-process-termination.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-registry.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-removable-storage.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-rpc-events.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-sam.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-security-group-management.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-security-state-change.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-security-system-extension.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-special-logon.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-system-integrity.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/audit-user-account-management.md",
+"redirect_url": "/windows/security/threat-protection/auditing/audit-user-device-claims.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/basic-audit-account-logon-events.md",
+"redirect_url": "/windows/security/threat-protection/auditing/basic-audit-account-management.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/basic-audit-directory-service-access.md",
+"redirect_url": "/windows/security/threat-protection/auditing/basic-audit-logon-events.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/basic-audit-object-access.md",
+"redirect_url": "/windows/security/threat-protection/auditing/basic-audit-policy-change.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/basic-audit-privilege-use.md",
+"redirect_url": "/windows/security/threat-protection/auditing/basic-audit-process-tracking.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/basic-audit-system-events.md",
+"redirect_url": "/windows/security/threat-protection/auditing/basic-security-audit-policies.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/basic-security-audit-policy-settings.md",
+"redirect_url": "/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-1100.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-1102.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-1104.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-1105.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-1108.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4608.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4610.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4611.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4612.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4614.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4615.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4616.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4618.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4621.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4622.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4624.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4625.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4626.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4627.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4634.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4647.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4648.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4649.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4656.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4657.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4658.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4660.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4661.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4662.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4663.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4664.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4670.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4671.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4672.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4673.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4674.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4675.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4688.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4689.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4690.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4691.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4692.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4693.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4694.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4695.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4696.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4697.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4698.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4699.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4700.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4701.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4702.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4703.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4704.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4705.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4706.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4707.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4713.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4714.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4715.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4716.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4717.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4718.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4719.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4720.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4722.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4723.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4724.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4725.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4726.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4731.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4732.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4733.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4734.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4735.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4738.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4739.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4740.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4741.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4742.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4743.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4749.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4750.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4751.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4752.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4753.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4764.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4765.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4766.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4767.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4768.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4769.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4770.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4771.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4772.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4773.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4774.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4775.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4776.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4777.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4778.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4779.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4780.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4781.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4782.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4793.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4794.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4798.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4799.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4800.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4801.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4802.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4803.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4816.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4817.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4818.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4819.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4826.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4864.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4865.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4866.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4867.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4902.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4904.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4905.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4906.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4907.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4908.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4909.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4910.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4911.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4912.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4913.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4928.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4929.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4930.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4931.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4932.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4933.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4934.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4935.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4936.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4937.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4944.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4945.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4946.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4947.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4948.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4949.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4950.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4951.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4952.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4953.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4954.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4956.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4957.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4958.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-4964.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-4985.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5024.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5025.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5027.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5028.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5029.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5030.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5031.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5032.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5033.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5034.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5035.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5037.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5038.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5039.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5051.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5056.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5057.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5058.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5059.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5060.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5061.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5062.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5063.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5064.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5065.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5066.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5067.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5068.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5069.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5070.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5136.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5137.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5138.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5139.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5140.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5141.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5142.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5143.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5144.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5145.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5148.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5149.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5150.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5151.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5152.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5153.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5154.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5155.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5156.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5157.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5158.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5159.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5168.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5376.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5377.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5378.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5447.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5632.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5633.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5712.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5888.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-5889.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-5890.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-6144.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-6145.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-6281.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-6400.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-6401.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-6402.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-6403.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-6404.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-6405.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-6406.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-6407.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-6408.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-6409.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-6410.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-6416.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-6419.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-6420.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-6421.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-6422.md",
+"redirect_url": "/windows/security/threat-protection/auditing/event-6423.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/event-6424.md",
+"redirect_url": "/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions.md",
+"redirect_url": "/windows/security/threat-protection/auditing/monitor-claim-types.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/monitor-resource-attribute-definitions.md",
+"redirect_url": "/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md",
+"redirect_url": "/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/monitor-the-use-of-removable-storage-devices.md",
+"redirect_url": "/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/other-events.md",
+"redirect_url": "/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/registry-global-object-access-auditing.md",
+"redirect_url": "/windows/security/threat-protection/auditing/security-auditing-overview.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md",
+"redirect_url": "/windows/security/threat-protection/auditing/view-the-security-event-log.md",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md",
+"redirect_url": "/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration",
+"redirect_document_id": true
+},
+{
 "source_path": "windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md",
 "redirect_url": "/windows/security/threat-protection/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set",
 "redirect_document_id": true
diff --git a/windows/device-security/auditing/advanced-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md
similarity index 100%
rename from windows/device-security/auditing/advanced-security-audit-policy-settings.md
rename to windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md
diff --git a/windows/device-security/auditing/advanced-security-auditing-faq.md b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md
similarity index 100%
rename from windows/device-security/auditing/advanced-security-auditing-faq.md
rename to windows/security/threat-protection/auditing/advanced-security-auditing-faq.md
diff --git a/windows/device-security/auditing/advanced-security-auditing.md b/windows/security/threat-protection/auditing/advanced-security-auditing.md
similarity index 100%
rename from windows/device-security/auditing/advanced-security-auditing.md
rename to windows/security/threat-protection/auditing/advanced-security-auditing.md
diff --git a/windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md b/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md
similarity index 100%
rename from windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md
rename to windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md
diff --git a/windows/device-security/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md
similarity index 100%
rename from windows/device-security/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md
rename to windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md
diff --git a/windows/device-security/auditing/audit-account-lockout.md b/windows/security/threat-protection/auditing/audit-account-lockout.md
similarity index 100%
rename from windows/device-security/auditing/audit-account-lockout.md
rename to windows/security/threat-protection/auditing/audit-account-lockout.md
diff --git a/windows/device-security/auditing/audit-application-generated.md b/windows/security/threat-protection/auditing/audit-application-generated.md
similarity index 100%
rename from windows/device-security/auditing/audit-application-generated.md
rename to windows/security/threat-protection/auditing/audit-application-generated.md
diff --git a/windows/device-security/auditing/audit-application-group-management.md b/windows/security/threat-protection/auditing/audit-application-group-management.md
similarity index 100%
rename from windows/device-security/auditing/audit-application-group-management.md
rename to windows/security/threat-protection/auditing/audit-application-group-management.md
diff --git a/windows/device-security/auditing/audit-audit-policy-change.md b/windows/security/threat-protection/auditing/audit-audit-policy-change.md
similarity index 100%
rename from windows/device-security/auditing/audit-audit-policy-change.md
rename to windows/security/threat-protection/auditing/audit-audit-policy-change.md
diff --git a/windows/device-security/auditing/audit-authentication-policy-change.md b/windows/security/threat-protection/auditing/audit-authentication-policy-change.md
similarity index 100%
rename from windows/device-security/auditing/audit-authentication-policy-change.md
rename to windows/security/threat-protection/auditing/audit-authentication-policy-change.md
diff --git a/windows/device-security/auditing/audit-authorization-policy-change.md b/windows/security/threat-protection/auditing/audit-authorization-policy-change.md
similarity index 100%
rename from windows/device-security/auditing/audit-authorization-policy-change.md
rename to windows/security/threat-protection/auditing/audit-authorization-policy-change.md
diff --git a/windows/device-security/auditing/audit-central-access-policy-staging.md b/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md
similarity index 100%
rename from windows/device-security/auditing/audit-central-access-policy-staging.md
rename to windows/security/threat-protection/auditing/audit-central-access-policy-staging.md
diff --git a/windows/device-security/auditing/audit-certification-services.md b/windows/security/threat-protection/auditing/audit-certification-services.md
similarity index 100%
rename from windows/device-security/auditing/audit-certification-services.md
rename to windows/security/threat-protection/auditing/audit-certification-services.md
diff --git a/windows/device-security/auditing/audit-computer-account-management.md b/windows/security/threat-protection/auditing/audit-computer-account-management.md
similarity index 100%
rename from windows/device-security/auditing/audit-computer-account-management.md
rename to windows/security/threat-protection/auditing/audit-computer-account-management.md
diff --git a/windows/device-security/auditing/audit-credential-validation.md b/windows/security/threat-protection/auditing/audit-credential-validation.md
similarity index 100%
rename from windows/device-security/auditing/audit-credential-validation.md
rename to windows/security/threat-protection/auditing/audit-credential-validation.md
diff --git a/windows/device-security/auditing/audit-detailed-directory-service-replication.md b/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md
similarity index 100%
rename from windows/device-security/auditing/audit-detailed-directory-service-replication.md
rename to windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md
diff --git a/windows/device-security/auditing/audit-detailed-file-share.md b/windows/security/threat-protection/auditing/audit-detailed-file-share.md
similarity index 100%
rename from windows/device-security/auditing/audit-detailed-file-share.md
rename to windows/security/threat-protection/auditing/audit-detailed-file-share.md
diff --git a/windows/device-security/auditing/audit-directory-service-access.md b/windows/security/threat-protection/auditing/audit-directory-service-access.md
similarity index 100%
rename from windows/device-security/auditing/audit-directory-service-access.md
rename to windows/security/threat-protection/auditing/audit-directory-service-access.md
diff --git a/windows/device-security/auditing/audit-directory-service-changes.md b/windows/security/threat-protection/auditing/audit-directory-service-changes.md
similarity index 100%
rename from windows/device-security/auditing/audit-directory-service-changes.md
rename to windows/security/threat-protection/auditing/audit-directory-service-changes.md
diff --git a/windows/device-security/auditing/audit-directory-service-replication.md b/windows/security/threat-protection/auditing/audit-directory-service-replication.md
similarity index 100%
rename from windows/device-security/auditing/audit-directory-service-replication.md
rename to windows/security/threat-protection/auditing/audit-directory-service-replication.md
diff --git a/windows/device-security/auditing/audit-distribution-group-management.md b/windows/security/threat-protection/auditing/audit-distribution-group-management.md
similarity index 100%
rename from windows/device-security/auditing/audit-distribution-group-management.md
rename to windows/security/threat-protection/auditing/audit-distribution-group-management.md
diff --git a/windows/device-security/auditing/audit-dpapi-activity.md b/windows/security/threat-protection/auditing/audit-dpapi-activity.md
similarity index 100%
rename from windows/device-security/auditing/audit-dpapi-activity.md
rename to windows/security/threat-protection/auditing/audit-dpapi-activity.md
diff --git a/windows/device-security/auditing/audit-file-share.md b/windows/security/threat-protection/auditing/audit-file-share.md
similarity index 100%
rename from windows/device-security/auditing/audit-file-share.md
rename to windows/security/threat-protection/auditing/audit-file-share.md
diff --git a/windows/device-security/auditing/audit-file-system.md b/windows/security/threat-protection/auditing/audit-file-system.md
similarity index 100%
rename from windows/device-security/auditing/audit-file-system.md
rename to windows/security/threat-protection/auditing/audit-file-system.md
diff --git a/windows/device-security/auditing/audit-filtering-platform-connection.md b/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md
similarity index 100%
rename from windows/device-security/auditing/audit-filtering-platform-connection.md
rename to windows/security/threat-protection/auditing/audit-filtering-platform-connection.md
diff --git a/windows/device-security/auditing/audit-filtering-platform-packet-drop.md b/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md
similarity index 100%
rename from windows/device-security/auditing/audit-filtering-platform-packet-drop.md
rename to windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md
diff --git a/windows/device-security/auditing/audit-filtering-platform-policy-change.md b/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md
similarity index 100%
rename from windows/device-security/auditing/audit-filtering-platform-policy-change.md
rename to windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md
diff --git a/windows/device-security/auditing/audit-group-membership.md b/windows/security/threat-protection/auditing/audit-group-membership.md
similarity index 100%
rename from windows/device-security/auditing/audit-group-membership.md
rename to windows/security/threat-protection/auditing/audit-group-membership.md
diff --git a/windows/device-security/auditing/audit-handle-manipulation.md b/windows/security/threat-protection/auditing/audit-handle-manipulation.md
similarity index 100%
rename from windows/device-security/auditing/audit-handle-manipulation.md
rename to windows/security/threat-protection/auditing/audit-handle-manipulation.md
diff --git a/windows/device-security/auditing/audit-ipsec-driver.md b/windows/security/threat-protection/auditing/audit-ipsec-driver.md
similarity index 100%
rename from windows/device-security/auditing/audit-ipsec-driver.md
rename to windows/security/threat-protection/auditing/audit-ipsec-driver.md
diff --git a/windows/device-security/auditing/audit-ipsec-extended-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md
similarity index 100%
rename from windows/device-security/auditing/audit-ipsec-extended-mode.md
rename to windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md
diff --git a/windows/device-security/auditing/audit-ipsec-main-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md
similarity index 100%
rename from windows/device-security/auditing/audit-ipsec-main-mode.md
rename to windows/security/threat-protection/auditing/audit-ipsec-main-mode.md
diff --git a/windows/device-security/auditing/audit-ipsec-quick-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md
similarity index 100%
rename from windows/device-security/auditing/audit-ipsec-quick-mode.md
rename to windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md
diff --git a/windows/device-security/auditing/audit-kerberos-authentication-service.md b/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md
similarity index 100%
rename from windows/device-security/auditing/audit-kerberos-authentication-service.md
rename to windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md
diff --git a/windows/device-security/auditing/audit-kerberos-service-ticket-operations.md b/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md
similarity index 100%
rename from windows/device-security/auditing/audit-kerberos-service-ticket-operations.md
rename to windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md
diff --git a/windows/device-security/auditing/audit-kernel-object.md b/windows/security/threat-protection/auditing/audit-kernel-object.md
similarity index 100%
rename from windows/device-security/auditing/audit-kernel-object.md
rename to windows/security/threat-protection/auditing/audit-kernel-object.md
diff --git a/windows/device-security/auditing/audit-logoff.md b/windows/security/threat-protection/auditing/audit-logoff.md
similarity index 100%
rename from windows/device-security/auditing/audit-logoff.md
rename to windows/security/threat-protection/auditing/audit-logoff.md
diff --git a/windows/device-security/auditing/audit-logon.md b/windows/security/threat-protection/auditing/audit-logon.md
similarity index 100%
rename from windows/device-security/auditing/audit-logon.md
rename to windows/security/threat-protection/auditing/audit-logon.md
diff --git a/windows/device-security/auditing/audit-mpssvc-rule-level-policy-change.md b/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md
similarity index 100%
rename from windows/device-security/auditing/audit-mpssvc-rule-level-policy-change.md
rename to windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md
diff --git a/windows/device-security/auditing/audit-network-policy-server.md b/windows/security/threat-protection/auditing/audit-network-policy-server.md
similarity index 100%
rename from windows/device-security/auditing/audit-network-policy-server.md
rename to windows/security/threat-protection/auditing/audit-network-policy-server.md
diff --git a/windows/device-security/auditing/audit-non-sensitive-privilege-use.md b/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md
similarity index 100%
rename from windows/device-security/auditing/audit-non-sensitive-privilege-use.md
rename to windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md
diff --git a/windows/device-security/auditing/audit-other-account-logon-events.md b/windows/security/threat-protection/auditing/audit-other-account-logon-events.md
similarity index 100%
rename from windows/device-security/auditing/audit-other-account-logon-events.md
rename to windows/security/threat-protection/auditing/audit-other-account-logon-events.md
diff --git a/windows/device-security/auditing/audit-other-account-management-events.md b/windows/security/threat-protection/auditing/audit-other-account-management-events.md
similarity index 100%
rename from windows/device-security/auditing/audit-other-account-management-events.md
rename to windows/security/threat-protection/auditing/audit-other-account-management-events.md
diff --git a/windows/device-security/auditing/audit-other-logonlogoff-events.md b/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md
similarity index 100%
rename from windows/device-security/auditing/audit-other-logonlogoff-events.md
rename to windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md
diff --git a/windows/device-security/auditing/audit-other-object-access-events.md b/windows/security/threat-protection/auditing/audit-other-object-access-events.md
similarity index 100%
rename from windows/device-security/auditing/audit-other-object-access-events.md
rename to windows/security/threat-protection/auditing/audit-other-object-access-events.md
diff --git a/windows/device-security/auditing/audit-other-policy-change-events.md b/windows/security/threat-protection/auditing/audit-other-policy-change-events.md
similarity index 100%
rename from windows/device-security/auditing/audit-other-policy-change-events.md
rename to windows/security/threat-protection/auditing/audit-other-policy-change-events.md
diff --git a/windows/device-security/auditing/audit-other-privilege-use-events.md b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md
similarity index 100%
rename from windows/device-security/auditing/audit-other-privilege-use-events.md
rename to windows/security/threat-protection/auditing/audit-other-privilege-use-events.md
diff --git a/windows/device-security/auditing/audit-other-system-events.md b/windows/security/threat-protection/auditing/audit-other-system-events.md
similarity index 100%
rename from windows/device-security/auditing/audit-other-system-events.md
rename to windows/security/threat-protection/auditing/audit-other-system-events.md
diff --git a/windows/device-security/auditing/audit-pnp-activity.md b/windows/security/threat-protection/auditing/audit-pnp-activity.md
similarity index 100%
rename from windows/device-security/auditing/audit-pnp-activity.md
rename to windows/security/threat-protection/auditing/audit-pnp-activity.md
diff --git a/windows/device-security/auditing/audit-process-creation.md b/windows/security/threat-protection/auditing/audit-process-creation.md
similarity index 100%
rename from windows/device-security/auditing/audit-process-creation.md
rename to windows/security/threat-protection/auditing/audit-process-creation.md
diff --git a/windows/device-security/auditing/audit-process-termination.md b/windows/security/threat-protection/auditing/audit-process-termination.md
similarity index 100%
rename from windows/device-security/auditing/audit-process-termination.md
rename to windows/security/threat-protection/auditing/audit-process-termination.md
diff --git a/windows/device-security/auditing/audit-registry.md b/windows/security/threat-protection/auditing/audit-registry.md
similarity index 100%
rename from windows/device-security/auditing/audit-registry.md
rename to windows/security/threat-protection/auditing/audit-registry.md
diff --git a/windows/device-security/auditing/audit-removable-storage.md b/windows/security/threat-protection/auditing/audit-removable-storage.md
similarity index 100%
rename from windows/device-security/auditing/audit-removable-storage.md
rename to windows/security/threat-protection/auditing/audit-removable-storage.md
diff --git a/windows/device-security/auditing/audit-rpc-events.md b/windows/security/threat-protection/auditing/audit-rpc-events.md
similarity index 100%
rename from windows/device-security/auditing/audit-rpc-events.md
rename to windows/security/threat-protection/auditing/audit-rpc-events.md
diff --git a/windows/device-security/auditing/audit-sam.md b/windows/security/threat-protection/auditing/audit-sam.md
similarity index 100%
rename from windows/device-security/auditing/audit-sam.md
rename to windows/security/threat-protection/auditing/audit-sam.md
diff --git a/windows/device-security/auditing/audit-security-group-management.md b/windows/security/threat-protection/auditing/audit-security-group-management.md
similarity index 100%
rename from windows/device-security/auditing/audit-security-group-management.md
rename to windows/security/threat-protection/auditing/audit-security-group-management.md
diff --git a/windows/device-security/auditing/audit-security-state-change.md b/windows/security/threat-protection/auditing/audit-security-state-change.md
similarity index 100%
rename from windows/device-security/auditing/audit-security-state-change.md
rename to windows/security/threat-protection/auditing/audit-security-state-change.md
diff --git a/windows/device-security/auditing/audit-security-system-extension.md b/windows/security/threat-protection/auditing/audit-security-system-extension.md
similarity index 100%
rename from windows/device-security/auditing/audit-security-system-extension.md
rename to windows/security/threat-protection/auditing/audit-security-system-extension.md
diff --git a/windows/device-security/auditing/audit-sensitive-privilege-use.md b/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md
similarity index 100%
rename from windows/device-security/auditing/audit-sensitive-privilege-use.md
rename to windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md
diff --git a/windows/device-security/auditing/audit-special-logon.md b/windows/security/threat-protection/auditing/audit-special-logon.md
similarity index 100%
rename from windows/device-security/auditing/audit-special-logon.md
rename to windows/security/threat-protection/auditing/audit-special-logon.md
diff --git a/windows/device-security/auditing/audit-system-integrity.md b/windows/security/threat-protection/auditing/audit-system-integrity.md
similarity index 100%
rename from windows/device-security/auditing/audit-system-integrity.md
rename to windows/security/threat-protection/auditing/audit-system-integrity.md
diff --git a/windows/device-security/auditing/audit-user-account-management.md b/windows/security/threat-protection/auditing/audit-user-account-management.md
similarity index 100%
rename from windows/device-security/auditing/audit-user-account-management.md
rename to windows/security/threat-protection/auditing/audit-user-account-management.md
diff --git a/windows/device-security/auditing/audit-user-device-claims.md b/windows/security/threat-protection/auditing/audit-user-device-claims.md
similarity index 100%
rename from windows/device-security/auditing/audit-user-device-claims.md
rename to windows/security/threat-protection/auditing/audit-user-device-claims.md
diff --git a/windows/device-security/auditing/basic-audit-account-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md
similarity index 100%
rename from windows/device-security/auditing/basic-audit-account-logon-events.md
rename to windows/security/threat-protection/auditing/basic-audit-account-logon-events.md
diff --git a/windows/device-security/auditing/basic-audit-account-management.md b/windows/security/threat-protection/auditing/basic-audit-account-management.md
similarity index 100%
rename from windows/device-security/auditing/basic-audit-account-management.md
rename to windows/security/threat-protection/auditing/basic-audit-account-management.md
diff --git a/windows/device-security/auditing/basic-audit-directory-service-access.md b/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md
similarity index 100%
rename from windows/device-security/auditing/basic-audit-directory-service-access.md
rename to windows/security/threat-protection/auditing/basic-audit-directory-service-access.md
diff --git a/windows/device-security/auditing/basic-audit-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-logon-events.md
similarity index 100%
rename from windows/device-security/auditing/basic-audit-logon-events.md
rename to windows/security/threat-protection/auditing/basic-audit-logon-events.md
diff --git a/windows/device-security/auditing/basic-audit-object-access.md b/windows/security/threat-protection/auditing/basic-audit-object-access.md
similarity index 100%
rename from windows/device-security/auditing/basic-audit-object-access.md
rename to windows/security/threat-protection/auditing/basic-audit-object-access.md
diff --git a/windows/device-security/auditing/basic-audit-policy-change.md b/windows/security/threat-protection/auditing/basic-audit-policy-change.md
similarity index 100%
rename from windows/device-security/auditing/basic-audit-policy-change.md
rename to windows/security/threat-protection/auditing/basic-audit-policy-change.md
diff --git a/windows/device-security/auditing/basic-audit-privilege-use.md b/windows/security/threat-protection/auditing/basic-audit-privilege-use.md
similarity index 100%
rename from windows/device-security/auditing/basic-audit-privilege-use.md
rename to windows/security/threat-protection/auditing/basic-audit-privilege-use.md
diff --git a/windows/device-security/auditing/basic-audit-process-tracking.md b/windows/security/threat-protection/auditing/basic-audit-process-tracking.md
similarity index 100%
rename from windows/device-security/auditing/basic-audit-process-tracking.md
rename to windows/security/threat-protection/auditing/basic-audit-process-tracking.md
diff --git a/windows/device-security/auditing/basic-audit-system-events.md b/windows/security/threat-protection/auditing/basic-audit-system-events.md
similarity index 100%
rename from windows/device-security/auditing/basic-audit-system-events.md
rename to windows/security/threat-protection/auditing/basic-audit-system-events.md
diff --git a/windows/device-security/auditing/basic-security-audit-policies.md b/windows/security/threat-protection/auditing/basic-security-audit-policies.md
similarity index 100%
rename from windows/device-security/auditing/basic-security-audit-policies.md
rename to windows/security/threat-protection/auditing/basic-security-audit-policies.md
diff --git a/windows/device-security/auditing/basic-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md
similarity index 100%
rename from windows/device-security/auditing/basic-security-audit-policy-settings.md
rename to windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md
diff --git a/windows/device-security/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md b/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md
similarity index 100%
rename from windows/device-security/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md
rename to windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md
diff --git a/windows/device-security/auditing/event-1100.md b/windows/security/threat-protection/auditing/event-1100.md
similarity index 100%
rename from windows/device-security/auditing/event-1100.md
rename to windows/security/threat-protection/auditing/event-1100.md
diff --git a/windows/device-security/auditing/event-1102.md b/windows/security/threat-protection/auditing/event-1102.md
similarity index 100%
rename from windows/device-security/auditing/event-1102.md
rename to windows/security/threat-protection/auditing/event-1102.md
diff --git a/windows/device-security/auditing/event-1104.md b/windows/security/threat-protection/auditing/event-1104.md
similarity index 100%
rename from windows/device-security/auditing/event-1104.md
rename to windows/security/threat-protection/auditing/event-1104.md
diff --git a/windows/device-security/auditing/event-1105.md b/windows/security/threat-protection/auditing/event-1105.md
similarity index 100%
rename from windows/device-security/auditing/event-1105.md
rename to windows/security/threat-protection/auditing/event-1105.md
diff --git a/windows/device-security/auditing/event-1108.md b/windows/security/threat-protection/auditing/event-1108.md
similarity index 100%
rename from windows/device-security/auditing/event-1108.md
rename to windows/security/threat-protection/auditing/event-1108.md
diff --git a/windows/device-security/auditing/event-4608.md b/windows/security/threat-protection/auditing/event-4608.md
similarity index 100%
rename from windows/device-security/auditing/event-4608.md
rename to windows/security/threat-protection/auditing/event-4608.md
diff --git a/windows/device-security/auditing/event-4610.md b/windows/security/threat-protection/auditing/event-4610.md
similarity index 100%
rename from windows/device-security/auditing/event-4610.md
rename to windows/security/threat-protection/auditing/event-4610.md
diff --git a/windows/device-security/auditing/event-4611.md b/windows/security/threat-protection/auditing/event-4611.md
similarity index 100%
rename from windows/device-security/auditing/event-4611.md
rename to windows/security/threat-protection/auditing/event-4611.md
diff --git a/windows/device-security/auditing/event-4612.md b/windows/security/threat-protection/auditing/event-4612.md
similarity index 100%
rename from windows/device-security/auditing/event-4612.md
rename to windows/security/threat-protection/auditing/event-4612.md
diff --git a/windows/device-security/auditing/event-4614.md b/windows/security/threat-protection/auditing/event-4614.md
similarity index 100%
rename from windows/device-security/auditing/event-4614.md
rename to windows/security/threat-protection/auditing/event-4614.md
diff --git a/windows/device-security/auditing/event-4615.md b/windows/security/threat-protection/auditing/event-4615.md
similarity index 100%
rename from windows/device-security/auditing/event-4615.md
rename to windows/security/threat-protection/auditing/event-4615.md
diff --git a/windows/device-security/auditing/event-4616.md b/windows/security/threat-protection/auditing/event-4616.md
similarity index 100%
rename from windows/device-security/auditing/event-4616.md
rename to windows/security/threat-protection/auditing/event-4616.md
diff --git a/windows/device-security/auditing/event-4618.md b/windows/security/threat-protection/auditing/event-4618.md
similarity index 100%
rename from windows/device-security/auditing/event-4618.md
rename to windows/security/threat-protection/auditing/event-4618.md
diff --git a/windows/device-security/auditing/event-4621.md b/windows/security/threat-protection/auditing/event-4621.md
similarity index 100%
rename from windows/device-security/auditing/event-4621.md
rename to windows/security/threat-protection/auditing/event-4621.md
diff --git a/windows/device-security/auditing/event-4622.md b/windows/security/threat-protection/auditing/event-4622.md
similarity index 100%
rename from windows/device-security/auditing/event-4622.md
rename to windows/security/threat-protection/auditing/event-4622.md
diff --git a/windows/device-security/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md
similarity index 100%
rename from windows/device-security/auditing/event-4624.md
rename to windows/security/threat-protection/auditing/event-4624.md
diff --git a/windows/device-security/auditing/event-4625.md b/windows/security/threat-protection/auditing/event-4625.md
similarity index 100%
rename from windows/device-security/auditing/event-4625.md
rename to windows/security/threat-protection/auditing/event-4625.md
diff --git a/windows/device-security/auditing/event-4626.md b/windows/security/threat-protection/auditing/event-4626.md
similarity index 100%
rename from windows/device-security/auditing/event-4626.md
rename to windows/security/threat-protection/auditing/event-4626.md
diff --git a/windows/device-security/auditing/event-4627.md b/windows/security/threat-protection/auditing/event-4627.md
similarity index 100%
rename from windows/device-security/auditing/event-4627.md
rename to windows/security/threat-protection/auditing/event-4627.md
diff --git a/windows/device-security/auditing/event-4634.md b/windows/security/threat-protection/auditing/event-4634.md
similarity index 100%
rename from windows/device-security/auditing/event-4634.md
rename to windows/security/threat-protection/auditing/event-4634.md
diff --git a/windows/device-security/auditing/event-4647.md b/windows/security/threat-protection/auditing/event-4647.md
similarity index 100%
rename from windows/device-security/auditing/event-4647.md
rename to windows/security/threat-protection/auditing/event-4647.md
diff --git a/windows/device-security/auditing/event-4648.md b/windows/security/threat-protection/auditing/event-4648.md
similarity index 100%
rename from windows/device-security/auditing/event-4648.md
rename to windows/security/threat-protection/auditing/event-4648.md
diff --git a/windows/device-security/auditing/event-4649.md b/windows/security/threat-protection/auditing/event-4649.md
similarity index 100%
rename from windows/device-security/auditing/event-4649.md
rename to windows/security/threat-protection/auditing/event-4649.md
diff --git a/windows/device-security/auditing/event-4656.md b/windows/security/threat-protection/auditing/event-4656.md
similarity index 100%
rename from windows/device-security/auditing/event-4656.md
rename to windows/security/threat-protection/auditing/event-4656.md
diff --git a/windows/device-security/auditing/event-4657.md b/windows/security/threat-protection/auditing/event-4657.md
similarity index 100%
rename from windows/device-security/auditing/event-4657.md
rename to windows/security/threat-protection/auditing/event-4657.md
diff --git a/windows/device-security/auditing/event-4658.md b/windows/security/threat-protection/auditing/event-4658.md
similarity index 100%
rename from windows/device-security/auditing/event-4658.md
rename to windows/security/threat-protection/auditing/event-4658.md
diff --git a/windows/device-security/auditing/event-4660.md b/windows/security/threat-protection/auditing/event-4660.md
similarity index 100%
rename from windows/device-security/auditing/event-4660.md
rename to windows/security/threat-protection/auditing/event-4660.md
diff --git a/windows/device-security/auditing/event-4661.md b/windows/security/threat-protection/auditing/event-4661.md
similarity index 100%
rename from windows/device-security/auditing/event-4661.md
rename to windows/security/threat-protection/auditing/event-4661.md
diff --git a/windows/device-security/auditing/event-4662.md b/windows/security/threat-protection/auditing/event-4662.md
similarity index 100%
rename from windows/device-security/auditing/event-4662.md
rename to windows/security/threat-protection/auditing/event-4662.md
diff --git a/windows/device-security/auditing/event-4663.md b/windows/security/threat-protection/auditing/event-4663.md
similarity index 100%
rename from windows/device-security/auditing/event-4663.md
rename to windows/security/threat-protection/auditing/event-4663.md
diff --git a/windows/device-security/auditing/event-4664.md b/windows/security/threat-protection/auditing/event-4664.md
similarity index 100%
rename from windows/device-security/auditing/event-4664.md
rename to windows/security/threat-protection/auditing/event-4664.md
diff --git a/windows/device-security/auditing/event-4670.md b/windows/security/threat-protection/auditing/event-4670.md
similarity index 100%
rename from windows/device-security/auditing/event-4670.md
rename to windows/security/threat-protection/auditing/event-4670.md
diff --git a/windows/device-security/auditing/event-4671.md b/windows/security/threat-protection/auditing/event-4671.md
similarity index 100%
rename from windows/device-security/auditing/event-4671.md
rename to windows/security/threat-protection/auditing/event-4671.md
diff --git a/windows/device-security/auditing/event-4672.md b/windows/security/threat-protection/auditing/event-4672.md
similarity index 100%
rename from windows/device-security/auditing/event-4672.md
rename to windows/security/threat-protection/auditing/event-4672.md
diff --git a/windows/device-security/auditing/event-4673.md b/windows/security/threat-protection/auditing/event-4673.md
similarity index 100%
rename from windows/device-security/auditing/event-4673.md
rename to windows/security/threat-protection/auditing/event-4673.md
diff --git a/windows/device-security/auditing/event-4674.md b/windows/security/threat-protection/auditing/event-4674.md
similarity index 100%
rename from windows/device-security/auditing/event-4674.md
rename to windows/security/threat-protection/auditing/event-4674.md
diff --git a/windows/device-security/auditing/event-4675.md b/windows/security/threat-protection/auditing/event-4675.md
similarity index 100%
rename from windows/device-security/auditing/event-4675.md
rename to windows/security/threat-protection/auditing/event-4675.md
diff --git a/windows/device-security/auditing/event-4688.md b/windows/security/threat-protection/auditing/event-4688.md
similarity index 100%
rename from windows/device-security/auditing/event-4688.md
rename to windows/security/threat-protection/auditing/event-4688.md
diff --git a/windows/device-security/auditing/event-4689.md b/windows/security/threat-protection/auditing/event-4689.md
similarity index 100%
rename from windows/device-security/auditing/event-4689.md
rename to windows/security/threat-protection/auditing/event-4689.md
diff --git a/windows/device-security/auditing/event-4690.md b/windows/security/threat-protection/auditing/event-4690.md
similarity index 100%
rename from windows/device-security/auditing/event-4690.md
rename to windows/security/threat-protection/auditing/event-4690.md
diff --git a/windows/device-security/auditing/event-4691.md b/windows/security/threat-protection/auditing/event-4691.md
similarity index 100%
rename from windows/device-security/auditing/event-4691.md
rename to windows/security/threat-protection/auditing/event-4691.md
diff --git a/windows/device-security/auditing/event-4692.md b/windows/security/threat-protection/auditing/event-4692.md
similarity index 100%
rename from windows/device-security/auditing/event-4692.md
rename to windows/security/threat-protection/auditing/event-4692.md
diff --git a/windows/device-security/auditing/event-4693.md b/windows/security/threat-protection/auditing/event-4693.md
similarity index 100%
rename from windows/device-security/auditing/event-4693.md
rename to windows/security/threat-protection/auditing/event-4693.md
diff --git a/windows/device-security/auditing/event-4694.md b/windows/security/threat-protection/auditing/event-4694.md
similarity index 100%
rename from windows/device-security/auditing/event-4694.md
rename to windows/security/threat-protection/auditing/event-4694.md
diff --git a/windows/device-security/auditing/event-4695.md b/windows/security/threat-protection/auditing/event-4695.md
similarity index 100%
rename from windows/device-security/auditing/event-4695.md
rename to windows/security/threat-protection/auditing/event-4695.md
diff --git a/windows/device-security/auditing/event-4696.md b/windows/security/threat-protection/auditing/event-4696.md
similarity index 100%
rename from windows/device-security/auditing/event-4696.md
rename to windows/security/threat-protection/auditing/event-4696.md
diff --git a/windows/device-security/auditing/event-4697.md b/windows/security/threat-protection/auditing/event-4697.md
similarity index 100%
rename from windows/device-security/auditing/event-4697.md
rename to windows/security/threat-protection/auditing/event-4697.md
diff --git a/windows/device-security/auditing/event-4698.md b/windows/security/threat-protection/auditing/event-4698.md
similarity index 100%
rename from windows/device-security/auditing/event-4698.md
rename to windows/security/threat-protection/auditing/event-4698.md
diff --git a/windows/device-security/auditing/event-4699.md b/windows/security/threat-protection/auditing/event-4699.md
similarity index 100%
rename from windows/device-security/auditing/event-4699.md
rename to windows/security/threat-protection/auditing/event-4699.md
diff --git a/windows/device-security/auditing/event-4700.md b/windows/security/threat-protection/auditing/event-4700.md
similarity index 100%
rename from windows/device-security/auditing/event-4700.md
rename to windows/security/threat-protection/auditing/event-4700.md
diff --git a/windows/device-security/auditing/event-4701.md b/windows/security/threat-protection/auditing/event-4701.md
similarity index 100%
rename from windows/device-security/auditing/event-4701.md
rename to windows/security/threat-protection/auditing/event-4701.md
diff --git a/windows/device-security/auditing/event-4702.md b/windows/security/threat-protection/auditing/event-4702.md
similarity index 100%
rename from windows/device-security/auditing/event-4702.md
rename to windows/security/threat-protection/auditing/event-4702.md
diff --git a/windows/device-security/auditing/event-4703.md b/windows/security/threat-protection/auditing/event-4703.md
similarity index 100%
rename from windows/device-security/auditing/event-4703.md
rename to windows/security/threat-protection/auditing/event-4703.md
diff --git a/windows/device-security/auditing/event-4704.md b/windows/security/threat-protection/auditing/event-4704.md
similarity index 100%
rename from windows/device-security/auditing/event-4704.md
rename to windows/security/threat-protection/auditing/event-4704.md
diff --git a/windows/device-security/auditing/event-4705.md b/windows/security/threat-protection/auditing/event-4705.md
similarity index 100%
rename from windows/device-security/auditing/event-4705.md
rename to windows/security/threat-protection/auditing/event-4705.md
diff --git a/windows/device-security/auditing/event-4706.md b/windows/security/threat-protection/auditing/event-4706.md
similarity index 100%
rename from windows/device-security/auditing/event-4706.md
rename to windows/security/threat-protection/auditing/event-4706.md
diff --git a/windows/device-security/auditing/event-4707.md b/windows/security/threat-protection/auditing/event-4707.md
similarity index 100%
rename from windows/device-security/auditing/event-4707.md
rename to windows/security/threat-protection/auditing/event-4707.md
diff --git a/windows/device-security/auditing/event-4713.md b/windows/security/threat-protection/auditing/event-4713.md
similarity index 100%
rename from windows/device-security/auditing/event-4713.md
rename to windows/security/threat-protection/auditing/event-4713.md
diff --git a/windows/device-security/auditing/event-4714.md b/windows/security/threat-protection/auditing/event-4714.md
similarity index 100%
rename from windows/device-security/auditing/event-4714.md
rename to windows/security/threat-protection/auditing/event-4714.md
diff --git a/windows/device-security/auditing/event-4715.md b/windows/security/threat-protection/auditing/event-4715.md
similarity index 100%
rename from windows/device-security/auditing/event-4715.md
rename to windows/security/threat-protection/auditing/event-4715.md
diff --git a/windows/device-security/auditing/event-4716.md b/windows/security/threat-protection/auditing/event-4716.md
similarity index 100%
rename from windows/device-security/auditing/event-4716.md
rename to windows/security/threat-protection/auditing/event-4716.md
diff --git a/windows/device-security/auditing/event-4717.md b/windows/security/threat-protection/auditing/event-4717.md
similarity index 100%
rename from windows/device-security/auditing/event-4717.md
rename to windows/security/threat-protection/auditing/event-4717.md
diff --git a/windows/device-security/auditing/event-4718.md b/windows/security/threat-protection/auditing/event-4718.md
similarity index 100%
rename from windows/device-security/auditing/event-4718.md
rename to windows/security/threat-protection/auditing/event-4718.md
diff --git a/windows/device-security/auditing/event-4719.md b/windows/security/threat-protection/auditing/event-4719.md
similarity index 100%
rename from windows/device-security/auditing/event-4719.md
rename to windows/security/threat-protection/auditing/event-4719.md
diff --git a/windows/device-security/auditing/event-4720.md b/windows/security/threat-protection/auditing/event-4720.md
similarity index 100%
rename from windows/device-security/auditing/event-4720.md
rename to windows/security/threat-protection/auditing/event-4720.md
diff --git a/windows/device-security/auditing/event-4722.md b/windows/security/threat-protection/auditing/event-4722.md
similarity index 100%
rename from windows/device-security/auditing/event-4722.md
rename to windows/security/threat-protection/auditing/event-4722.md
diff --git a/windows/device-security/auditing/event-4723.md b/windows/security/threat-protection/auditing/event-4723.md
similarity index 100%
rename from windows/device-security/auditing/event-4723.md
rename to windows/security/threat-protection/auditing/event-4723.md
diff --git a/windows/device-security/auditing/event-4724.md b/windows/security/threat-protection/auditing/event-4724.md
similarity index 100%
rename from windows/device-security/auditing/event-4724.md
rename to windows/security/threat-protection/auditing/event-4724.md
diff --git a/windows/device-security/auditing/event-4725.md b/windows/security/threat-protection/auditing/event-4725.md
similarity index 100%
rename from windows/device-security/auditing/event-4725.md
rename to windows/security/threat-protection/auditing/event-4725.md
diff --git a/windows/device-security/auditing/event-4726.md b/windows/security/threat-protection/auditing/event-4726.md
similarity index 100%
rename from windows/device-security/auditing/event-4726.md
rename to windows/security/threat-protection/auditing/event-4726.md
diff --git a/windows/device-security/auditing/event-4731.md b/windows/security/threat-protection/auditing/event-4731.md
similarity index 100%
rename from windows/device-security/auditing/event-4731.md
rename to windows/security/threat-protection/auditing/event-4731.md
diff --git a/windows/device-security/auditing/event-4732.md b/windows/security/threat-protection/auditing/event-4732.md
similarity index 100%
rename from windows/device-security/auditing/event-4732.md
rename to windows/security/threat-protection/auditing/event-4732.md
diff --git a/windows/device-security/auditing/event-4733.md b/windows/security/threat-protection/auditing/event-4733.md
similarity index 100%
rename from windows/device-security/auditing/event-4733.md
rename to windows/security/threat-protection/auditing/event-4733.md
diff --git a/windows/device-security/auditing/event-4734.md b/windows/security/threat-protection/auditing/event-4734.md
similarity index 100%
rename from windows/device-security/auditing/event-4734.md
rename to windows/security/threat-protection/auditing/event-4734.md
diff --git a/windows/device-security/auditing/event-4735.md b/windows/security/threat-protection/auditing/event-4735.md
similarity index 100%
rename from windows/device-security/auditing/event-4735.md
rename to windows/security/threat-protection/auditing/event-4735.md
diff --git a/windows/device-security/auditing/event-4738.md b/windows/security/threat-protection/auditing/event-4738.md
similarity index 100%
rename from windows/device-security/auditing/event-4738.md
rename to windows/security/threat-protection/auditing/event-4738.md
diff --git a/windows/device-security/auditing/event-4739.md b/windows/security/threat-protection/auditing/event-4739.md
similarity index 100%
rename from windows/device-security/auditing/event-4739.md
rename to windows/security/threat-protection/auditing/event-4739.md
diff --git a/windows/device-security/auditing/event-4740.md b/windows/security/threat-protection/auditing/event-4740.md
similarity index 100%
rename from windows/device-security/auditing/event-4740.md
rename to windows/security/threat-protection/auditing/event-4740.md
diff --git a/windows/device-security/auditing/event-4741.md b/windows/security/threat-protection/auditing/event-4741.md
similarity index 100%
rename from windows/device-security/auditing/event-4741.md
rename to windows/security/threat-protection/auditing/event-4741.md
diff --git a/windows/device-security/auditing/event-4742.md b/windows/security/threat-protection/auditing/event-4742.md
similarity index 100%
rename from windows/device-security/auditing/event-4742.md
rename to windows/security/threat-protection/auditing/event-4742.md
diff --git a/windows/device-security/auditing/event-4743.md b/windows/security/threat-protection/auditing/event-4743.md
similarity index 100%
rename from windows/device-security/auditing/event-4743.md
rename to windows/security/threat-protection/auditing/event-4743.md
diff --git a/windows/device-security/auditing/event-4749.md b/windows/security/threat-protection/auditing/event-4749.md
similarity index 100%
rename from windows/device-security/auditing/event-4749.md
rename to windows/security/threat-protection/auditing/event-4749.md
diff --git a/windows/device-security/auditing/event-4750.md b/windows/security/threat-protection/auditing/event-4750.md
similarity index 100%
rename from windows/device-security/auditing/event-4750.md
rename to windows/security/threat-protection/auditing/event-4750.md
diff --git a/windows/device-security/auditing/event-4751.md b/windows/security/threat-protection/auditing/event-4751.md
similarity index 100%
rename from windows/device-security/auditing/event-4751.md
rename to windows/security/threat-protection/auditing/event-4751.md
diff --git a/windows/device-security/auditing/event-4752.md b/windows/security/threat-protection/auditing/event-4752.md
similarity index 100%
rename from windows/device-security/auditing/event-4752.md
rename to windows/security/threat-protection/auditing/event-4752.md
diff --git a/windows/device-security/auditing/event-4753.md b/windows/security/threat-protection/auditing/event-4753.md
similarity index 100%
rename from windows/device-security/auditing/event-4753.md
rename to windows/security/threat-protection/auditing/event-4753.md
diff --git a/windows/device-security/auditing/event-4764.md b/windows/security/threat-protection/auditing/event-4764.md
similarity index 100%
rename from windows/device-security/auditing/event-4764.md
rename to windows/security/threat-protection/auditing/event-4764.md
diff --git a/windows/device-security/auditing/event-4765.md b/windows/security/threat-protection/auditing/event-4765.md
similarity index 100%
rename from windows/device-security/auditing/event-4765.md
rename to windows/security/threat-protection/auditing/event-4765.md
diff --git a/windows/device-security/auditing/event-4766.md b/windows/security/threat-protection/auditing/event-4766.md
similarity index 100%
rename from windows/device-security/auditing/event-4766.md
rename to windows/security/threat-protection/auditing/event-4766.md
diff --git a/windows/device-security/auditing/event-4767.md b/windows/security/threat-protection/auditing/event-4767.md
similarity index 100%
rename from windows/device-security/auditing/event-4767.md
rename to windows/security/threat-protection/auditing/event-4767.md
diff --git a/windows/device-security/auditing/event-4768.md b/windows/security/threat-protection/auditing/event-4768.md
similarity index 100%
rename from windows/device-security/auditing/event-4768.md
rename to windows/security/threat-protection/auditing/event-4768.md
diff --git a/windows/device-security/auditing/event-4769.md b/windows/security/threat-protection/auditing/event-4769.md
similarity index 100%
rename from windows/device-security/auditing/event-4769.md
rename to windows/security/threat-protection/auditing/event-4769.md
diff --git a/windows/device-security/auditing/event-4770.md b/windows/security/threat-protection/auditing/event-4770.md
similarity index 100%
rename from windows/device-security/auditing/event-4770.md
rename to windows/security/threat-protection/auditing/event-4770.md
diff --git a/windows/device-security/auditing/event-4771.md b/windows/security/threat-protection/auditing/event-4771.md
similarity index 100%
rename from windows/device-security/auditing/event-4771.md
rename to windows/security/threat-protection/auditing/event-4771.md
diff --git a/windows/device-security/auditing/event-4772.md b/windows/security/threat-protection/auditing/event-4772.md
similarity index 100%
rename from windows/device-security/auditing/event-4772.md
rename to windows/security/threat-protection/auditing/event-4772.md
diff --git a/windows/device-security/auditing/event-4773.md b/windows/security/threat-protection/auditing/event-4773.md
similarity index 100%
rename from windows/device-security/auditing/event-4773.md
rename to windows/security/threat-protection/auditing/event-4773.md
diff --git a/windows/device-security/auditing/event-4774.md b/windows/security/threat-protection/auditing/event-4774.md
similarity index 100%
rename from windows/device-security/auditing/event-4774.md
rename to windows/security/threat-protection/auditing/event-4774.md
diff --git a/windows/device-security/auditing/event-4775.md b/windows/security/threat-protection/auditing/event-4775.md
similarity index 100%
rename from windows/device-security/auditing/event-4775.md
rename to windows/security/threat-protection/auditing/event-4775.md
diff --git a/windows/device-security/auditing/event-4776.md b/windows/security/threat-protection/auditing/event-4776.md
similarity index 100%
rename from windows/device-security/auditing/event-4776.md
rename to windows/security/threat-protection/auditing/event-4776.md
diff --git a/windows/device-security/auditing/event-4777.md b/windows/security/threat-protection/auditing/event-4777.md
similarity index 100%
rename from windows/device-security/auditing/event-4777.md
rename to windows/security/threat-protection/auditing/event-4777.md
diff --git a/windows/device-security/auditing/event-4778.md b/windows/security/threat-protection/auditing/event-4778.md
similarity index 100%
rename from windows/device-security/auditing/event-4778.md
rename to windows/security/threat-protection/auditing/event-4778.md
diff --git a/windows/device-security/auditing/event-4779.md b/windows/security/threat-protection/auditing/event-4779.md
similarity index 100%
rename from windows/device-security/auditing/event-4779.md
rename to windows/security/threat-protection/auditing/event-4779.md
diff --git a/windows/device-security/auditing/event-4780.md b/windows/security/threat-protection/auditing/event-4780.md
similarity index 100%
rename from windows/device-security/auditing/event-4780.md
rename to windows/security/threat-protection/auditing/event-4780.md
diff --git a/windows/device-security/auditing/event-4781.md b/windows/security/threat-protection/auditing/event-4781.md
similarity index 100%
rename from windows/device-security/auditing/event-4781.md
rename to windows/security/threat-protection/auditing/event-4781.md
diff --git a/windows/device-security/auditing/event-4782.md b/windows/security/threat-protection/auditing/event-4782.md
similarity index 100%
rename from windows/device-security/auditing/event-4782.md
rename to windows/security/threat-protection/auditing/event-4782.md
diff --git a/windows/device-security/auditing/event-4793.md b/windows/security/threat-protection/auditing/event-4793.md
similarity index 100%
rename from windows/device-security/auditing/event-4793.md
rename to windows/security/threat-protection/auditing/event-4793.md
diff --git a/windows/device-security/auditing/event-4794.md b/windows/security/threat-protection/auditing/event-4794.md
similarity index 100%
rename from windows/device-security/auditing/event-4794.md
rename to windows/security/threat-protection/auditing/event-4794.md
diff --git a/windows/device-security/auditing/event-4798.md b/windows/security/threat-protection/auditing/event-4798.md
similarity index 100%
rename from windows/device-security/auditing/event-4798.md
rename to windows/security/threat-protection/auditing/event-4798.md
diff --git a/windows/device-security/auditing/event-4799.md b/windows/security/threat-protection/auditing/event-4799.md
similarity index 100%
rename from windows/device-security/auditing/event-4799.md
rename to windows/security/threat-protection/auditing/event-4799.md
diff --git a/windows/device-security/auditing/event-4800.md b/windows/security/threat-protection/auditing/event-4800.md
similarity index 100%
rename from windows/device-security/auditing/event-4800.md
rename to windows/security/threat-protection/auditing/event-4800.md
diff --git a/windows/device-security/auditing/event-4801.md b/windows/security/threat-protection/auditing/event-4801.md
similarity index 100%
rename from windows/device-security/auditing/event-4801.md
rename to windows/security/threat-protection/auditing/event-4801.md
diff --git a/windows/device-security/auditing/event-4802.md b/windows/security/threat-protection/auditing/event-4802.md
similarity index 100%
rename from windows/device-security/auditing/event-4802.md
rename to windows/security/threat-protection/auditing/event-4802.md
diff --git a/windows/device-security/auditing/event-4803.md b/windows/security/threat-protection/auditing/event-4803.md
similarity index 100%
rename from windows/device-security/auditing/event-4803.md
rename to windows/security/threat-protection/auditing/event-4803.md
diff --git a/windows/device-security/auditing/event-4816.md b/windows/security/threat-protection/auditing/event-4816.md
similarity index 100%
rename from windows/device-security/auditing/event-4816.md
rename to windows/security/threat-protection/auditing/event-4816.md
diff --git a/windows/device-security/auditing/event-4817.md b/windows/security/threat-protection/auditing/event-4817.md
similarity index 100%
rename from windows/device-security/auditing/event-4817.md
rename to windows/security/threat-protection/auditing/event-4817.md
diff --git a/windows/device-security/auditing/event-4818.md b/windows/security/threat-protection/auditing/event-4818.md
similarity index 100%
rename from windows/device-security/auditing/event-4818.md
rename to windows/security/threat-protection/auditing/event-4818.md
diff --git a/windows/device-security/auditing/event-4819.md b/windows/security/threat-protection/auditing/event-4819.md
similarity index 100%
rename from windows/device-security/auditing/event-4819.md
rename to windows/security/threat-protection/auditing/event-4819.md
diff --git a/windows/device-security/auditing/event-4826.md b/windows/security/threat-protection/auditing/event-4826.md
similarity index 100%
rename from windows/device-security/auditing/event-4826.md
rename to windows/security/threat-protection/auditing/event-4826.md
diff --git a/windows/device-security/auditing/event-4864.md b/windows/security/threat-protection/auditing/event-4864.md
similarity index 100%
rename from windows/device-security/auditing/event-4864.md
rename to windows/security/threat-protection/auditing/event-4864.md
diff --git a/windows/device-security/auditing/event-4865.md b/windows/security/threat-protection/auditing/event-4865.md
similarity index 100%
rename from windows/device-security/auditing/event-4865.md
rename to windows/security/threat-protection/auditing/event-4865.md
diff --git a/windows/device-security/auditing/event-4866.md b/windows/security/threat-protection/auditing/event-4866.md
similarity index 100%
rename from windows/device-security/auditing/event-4866.md
rename to windows/security/threat-protection/auditing/event-4866.md
diff --git a/windows/device-security/auditing/event-4867.md b/windows/security/threat-protection/auditing/event-4867.md
similarity index 100%
rename from windows/device-security/auditing/event-4867.md
rename to windows/security/threat-protection/auditing/event-4867.md
diff --git a/windows/device-security/auditing/event-4902.md b/windows/security/threat-protection/auditing/event-4902.md
similarity index 100%
rename from windows/device-security/auditing/event-4902.md
rename to windows/security/threat-protection/auditing/event-4902.md
diff --git a/windows/device-security/auditing/event-4904.md b/windows/security/threat-protection/auditing/event-4904.md
similarity index 100%
rename from windows/device-security/auditing/event-4904.md
rename to windows/security/threat-protection/auditing/event-4904.md
diff --git a/windows/device-security/auditing/event-4905.md b/windows/security/threat-protection/auditing/event-4905.md
similarity index 100%
rename from windows/device-security/auditing/event-4905.md
rename to windows/security/threat-protection/auditing/event-4905.md
diff --git a/windows/device-security/auditing/event-4906.md b/windows/security/threat-protection/auditing/event-4906.md
similarity index 100%
rename from windows/device-security/auditing/event-4906.md
rename to windows/security/threat-protection/auditing/event-4906.md
diff --git a/windows/device-security/auditing/event-4907.md b/windows/security/threat-protection/auditing/event-4907.md
similarity index 100%
rename from windows/device-security/auditing/event-4907.md
rename to windows/security/threat-protection/auditing/event-4907.md
diff --git a/windows/device-security/auditing/event-4908.md b/windows/security/threat-protection/auditing/event-4908.md
similarity index 100%
rename from windows/device-security/auditing/event-4908.md
rename to windows/security/threat-protection/auditing/event-4908.md
diff --git a/windows/device-security/auditing/event-4909.md b/windows/security/threat-protection/auditing/event-4909.md
similarity index 100%
rename from windows/device-security/auditing/event-4909.md
rename to windows/security/threat-protection/auditing/event-4909.md
diff --git a/windows/device-security/auditing/event-4910.md b/windows/security/threat-protection/auditing/event-4910.md
similarity index 100%
rename from windows/device-security/auditing/event-4910.md
rename to windows/security/threat-protection/auditing/event-4910.md
diff --git a/windows/device-security/auditing/event-4911.md b/windows/security/threat-protection/auditing/event-4911.md
similarity index 100%
rename from windows/device-security/auditing/event-4911.md
rename to windows/security/threat-protection/auditing/event-4911.md
diff --git a/windows/device-security/auditing/event-4912.md b/windows/security/threat-protection/auditing/event-4912.md
similarity index 100%
rename from windows/device-security/auditing/event-4912.md
rename to windows/security/threat-protection/auditing/event-4912.md
diff --git a/windows/device-security/auditing/event-4913.md b/windows/security/threat-protection/auditing/event-4913.md
similarity index 100%
rename from windows/device-security/auditing/event-4913.md
rename to windows/security/threat-protection/auditing/event-4913.md
diff --git a/windows/device-security/auditing/event-4928.md b/windows/security/threat-protection/auditing/event-4928.md
similarity index 100%
rename from windows/device-security/auditing/event-4928.md
rename to windows/security/threat-protection/auditing/event-4928.md
diff --git a/windows/device-security/auditing/event-4929.md b/windows/security/threat-protection/auditing/event-4929.md
similarity index 100%
rename from windows/device-security/auditing/event-4929.md
rename to windows/security/threat-protection/auditing/event-4929.md
diff --git a/windows/device-security/auditing/event-4930.md b/windows/security/threat-protection/auditing/event-4930.md
similarity index 100%
rename from windows/device-security/auditing/event-4930.md
rename to windows/security/threat-protection/auditing/event-4930.md
diff --git a/windows/device-security/auditing/event-4931.md b/windows/security/threat-protection/auditing/event-4931.md
similarity index 100%
rename from windows/device-security/auditing/event-4931.md
rename to windows/security/threat-protection/auditing/event-4931.md
diff --git a/windows/device-security/auditing/event-4932.md b/windows/security/threat-protection/auditing/event-4932.md
similarity index 100%
rename from windows/device-security/auditing/event-4932.md
rename to windows/security/threat-protection/auditing/event-4932.md
diff --git a/windows/device-security/auditing/event-4933.md b/windows/security/threat-protection/auditing/event-4933.md
similarity index 100%
rename from windows/device-security/auditing/event-4933.md
rename to windows/security/threat-protection/auditing/event-4933.md
diff --git a/windows/device-security/auditing/event-4934.md b/windows/security/threat-protection/auditing/event-4934.md
similarity index 100%
rename from windows/device-security/auditing/event-4934.md
rename to windows/security/threat-protection/auditing/event-4934.md
diff --git a/windows/device-security/auditing/event-4935.md b/windows/security/threat-protection/auditing/event-4935.md
similarity index 100%
rename from windows/device-security/auditing/event-4935.md
rename to windows/security/threat-protection/auditing/event-4935.md
diff --git a/windows/device-security/auditing/event-4936.md b/windows/security/threat-protection/auditing/event-4936.md
similarity index 100%
rename from windows/device-security/auditing/event-4936.md
rename to windows/security/threat-protection/auditing/event-4936.md
diff --git a/windows/device-security/auditing/event-4937.md b/windows/security/threat-protection/auditing/event-4937.md
similarity index 100%
rename from windows/device-security/auditing/event-4937.md
rename to windows/security/threat-protection/auditing/event-4937.md
diff --git a/windows/device-security/auditing/event-4944.md b/windows/security/threat-protection/auditing/event-4944.md
similarity index 100%
rename from windows/device-security/auditing/event-4944.md
rename to windows/security/threat-protection/auditing/event-4944.md
diff --git a/windows/device-security/auditing/event-4945.md b/windows/security/threat-protection/auditing/event-4945.md
similarity index 100%
rename from windows/device-security/auditing/event-4945.md
rename to windows/security/threat-protection/auditing/event-4945.md
diff --git a/windows/device-security/auditing/event-4946.md b/windows/security/threat-protection/auditing/event-4946.md
similarity index 100%
rename from windows/device-security/auditing/event-4946.md
rename to windows/security/threat-protection/auditing/event-4946.md
diff --git a/windows/device-security/auditing/event-4947.md b/windows/security/threat-protection/auditing/event-4947.md
similarity index 100%
rename from windows/device-security/auditing/event-4947.md
rename to windows/security/threat-protection/auditing/event-4947.md
diff --git a/windows/device-security/auditing/event-4948.md b/windows/security/threat-protection/auditing/event-4948.md
similarity index 100%
rename from windows/device-security/auditing/event-4948.md
rename to windows/security/threat-protection/auditing/event-4948.md
diff --git a/windows/device-security/auditing/event-4949.md b/windows/security/threat-protection/auditing/event-4949.md
similarity index 100%
rename from windows/device-security/auditing/event-4949.md
rename to windows/security/threat-protection/auditing/event-4949.md
diff --git a/windows/device-security/auditing/event-4950.md b/windows/security/threat-protection/auditing/event-4950.md
similarity index 100%
rename from windows/device-security/auditing/event-4950.md
rename to windows/security/threat-protection/auditing/event-4950.md
diff --git a/windows/device-security/auditing/event-4951.md b/windows/security/threat-protection/auditing/event-4951.md
similarity index 100%
rename from windows/device-security/auditing/event-4951.md
rename to windows/security/threat-protection/auditing/event-4951.md
diff --git a/windows/device-security/auditing/event-4952.md b/windows/security/threat-protection/auditing/event-4952.md
similarity index 100%
rename from windows/device-security/auditing/event-4952.md
rename to windows/security/threat-protection/auditing/event-4952.md
diff --git a/windows/device-security/auditing/event-4953.md b/windows/security/threat-protection/auditing/event-4953.md
similarity index 100%
rename from windows/device-security/auditing/event-4953.md
rename to windows/security/threat-protection/auditing/event-4953.md
diff --git a/windows/device-security/auditing/event-4954.md b/windows/security/threat-protection/auditing/event-4954.md
similarity index 100%
rename from windows/device-security/auditing/event-4954.md
rename to windows/security/threat-protection/auditing/event-4954.md
diff --git a/windows/device-security/auditing/event-4956.md b/windows/security/threat-protection/auditing/event-4956.md
similarity index 100%
rename from windows/device-security/auditing/event-4956.md
rename to windows/security/threat-protection/auditing/event-4956.md
diff --git a/windows/device-security/auditing/event-4957.md b/windows/security/threat-protection/auditing/event-4957.md
similarity index 100%
rename from windows/device-security/auditing/event-4957.md
rename to windows/security/threat-protection/auditing/event-4957.md
diff --git a/windows/device-security/auditing/event-4958.md b/windows/security/threat-protection/auditing/event-4958.md
similarity index 100%
rename from windows/device-security/auditing/event-4958.md
rename to windows/security/threat-protection/auditing/event-4958.md
diff --git a/windows/device-security/auditing/event-4964.md b/windows/security/threat-protection/auditing/event-4964.md
similarity index 100%
rename from windows/device-security/auditing/event-4964.md
rename to windows/security/threat-protection/auditing/event-4964.md
diff --git a/windows/device-security/auditing/event-4985.md b/windows/security/threat-protection/auditing/event-4985.md
similarity index 100%
rename from windows/device-security/auditing/event-4985.md
rename to windows/security/threat-protection/auditing/event-4985.md
diff --git a/windows/device-security/auditing/event-5024.md b/windows/security/threat-protection/auditing/event-5024.md
similarity index 100%
rename from windows/device-security/auditing/event-5024.md
rename to windows/security/threat-protection/auditing/event-5024.md
diff --git a/windows/device-security/auditing/event-5025.md b/windows/security/threat-protection/auditing/event-5025.md
similarity index 100%
rename from windows/device-security/auditing/event-5025.md
rename to windows/security/threat-protection/auditing/event-5025.md
diff --git a/windows/device-security/auditing/event-5027.md b/windows/security/threat-protection/auditing/event-5027.md
similarity index 100%
rename from windows/device-security/auditing/event-5027.md
rename to windows/security/threat-protection/auditing/event-5027.md
diff --git a/windows/device-security/auditing/event-5028.md b/windows/security/threat-protection/auditing/event-5028.md
similarity index 100%
rename from windows/device-security/auditing/event-5028.md
rename to windows/security/threat-protection/auditing/event-5028.md
diff --git a/windows/device-security/auditing/event-5029.md b/windows/security/threat-protection/auditing/event-5029.md
similarity index 100%
rename from windows/device-security/auditing/event-5029.md
rename to windows/security/threat-protection/auditing/event-5029.md
diff --git a/windows/device-security/auditing/event-5030.md b/windows/security/threat-protection/auditing/event-5030.md
similarity index 100%
rename from windows/device-security/auditing/event-5030.md
rename to windows/security/threat-protection/auditing/event-5030.md
diff --git a/windows/device-security/auditing/event-5031.md b/windows/security/threat-protection/auditing/event-5031.md
similarity index 100%
rename from windows/device-security/auditing/event-5031.md
rename to windows/security/threat-protection/auditing/event-5031.md
diff --git a/windows/device-security/auditing/event-5032.md b/windows/security/threat-protection/auditing/event-5032.md
similarity index 100%
rename from windows/device-security/auditing/event-5032.md
rename to windows/security/threat-protection/auditing/event-5032.md
diff --git a/windows/device-security/auditing/event-5033.md b/windows/security/threat-protection/auditing/event-5033.md
similarity index 100%
rename from windows/device-security/auditing/event-5033.md
rename to windows/security/threat-protection/auditing/event-5033.md
diff --git a/windows/device-security/auditing/event-5034.md b/windows/security/threat-protection/auditing/event-5034.md
similarity index 100%
rename from windows/device-security/auditing/event-5034.md
rename to windows/security/threat-protection/auditing/event-5034.md
diff --git a/windows/device-security/auditing/event-5035.md b/windows/security/threat-protection/auditing/event-5035.md
similarity index 100%
rename from windows/device-security/auditing/event-5035.md
rename to windows/security/threat-protection/auditing/event-5035.md
diff --git a/windows/device-security/auditing/event-5037.md b/windows/security/threat-protection/auditing/event-5037.md
similarity index 100%
rename from windows/device-security/auditing/event-5037.md
rename to windows/security/threat-protection/auditing/event-5037.md
diff --git a/windows/device-security/auditing/event-5038.md b/windows/security/threat-protection/auditing/event-5038.md
similarity index 100%
rename from windows/device-security/auditing/event-5038.md
rename to windows/security/threat-protection/auditing/event-5038.md
diff --git a/windows/device-security/auditing/event-5039.md b/windows/security/threat-protection/auditing/event-5039.md
similarity index 100%
rename from windows/device-security/auditing/event-5039.md
rename to windows/security/threat-protection/auditing/event-5039.md
diff --git a/windows/device-security/auditing/event-5051.md b/windows/security/threat-protection/auditing/event-5051.md
similarity index 100%
rename from windows/device-security/auditing/event-5051.md
rename to windows/security/threat-protection/auditing/event-5051.md
diff --git a/windows/device-security/auditing/event-5056.md b/windows/security/threat-protection/auditing/event-5056.md
similarity index 100%
rename from windows/device-security/auditing/event-5056.md
rename to windows/security/threat-protection/auditing/event-5056.md
diff --git a/windows/device-security/auditing/event-5057.md b/windows/security/threat-protection/auditing/event-5057.md
similarity index 100%
rename from windows/device-security/auditing/event-5057.md
rename to windows/security/threat-protection/auditing/event-5057.md
diff --git a/windows/device-security/auditing/event-5058.md b/windows/security/threat-protection/auditing/event-5058.md
similarity index 100%
rename from windows/device-security/auditing/event-5058.md
rename to windows/security/threat-protection/auditing/event-5058.md
diff --git a/windows/device-security/auditing/event-5059.md b/windows/security/threat-protection/auditing/event-5059.md
similarity index 100%
rename from windows/device-security/auditing/event-5059.md
rename to windows/security/threat-protection/auditing/event-5059.md
diff --git a/windows/device-security/auditing/event-5060.md b/windows/security/threat-protection/auditing/event-5060.md
similarity index 100%
rename from windows/device-security/auditing/event-5060.md
rename to windows/security/threat-protection/auditing/event-5060.md
diff --git a/windows/device-security/auditing/event-5061.md b/windows/security/threat-protection/auditing/event-5061.md
similarity index 100%
rename from windows/device-security/auditing/event-5061.md
rename to windows/security/threat-protection/auditing/event-5061.md
diff --git a/windows/device-security/auditing/event-5062.md b/windows/security/threat-protection/auditing/event-5062.md
similarity index 100%
rename from windows/device-security/auditing/event-5062.md
rename to windows/security/threat-protection/auditing/event-5062.md
diff --git a/windows/device-security/auditing/event-5063.md b/windows/security/threat-protection/auditing/event-5063.md
similarity index 100%
rename from windows/device-security/auditing/event-5063.md
rename to windows/security/threat-protection/auditing/event-5063.md
diff --git a/windows/device-security/auditing/event-5064.md b/windows/security/threat-protection/auditing/event-5064.md
similarity index 100%
rename from windows/device-security/auditing/event-5064.md
rename to windows/security/threat-protection/auditing/event-5064.md
diff --git a/windows/device-security/auditing/event-5065.md b/windows/security/threat-protection/auditing/event-5065.md
similarity index 100%
rename from windows/device-security/auditing/event-5065.md
rename to windows/security/threat-protection/auditing/event-5065.md
diff --git a/windows/device-security/auditing/event-5066.md b/windows/security/threat-protection/auditing/event-5066.md
similarity index 100%
rename from windows/device-security/auditing/event-5066.md
rename to windows/security/threat-protection/auditing/event-5066.md
diff --git a/windows/device-security/auditing/event-5067.md b/windows/security/threat-protection/auditing/event-5067.md
similarity index 100%
rename from windows/device-security/auditing/event-5067.md
rename to windows/security/threat-protection/auditing/event-5067.md
diff --git a/windows/device-security/auditing/event-5068.md b/windows/security/threat-protection/auditing/event-5068.md
similarity index 100%
rename from windows/device-security/auditing/event-5068.md
rename to windows/security/threat-protection/auditing/event-5068.md
diff --git a/windows/device-security/auditing/event-5069.md b/windows/security/threat-protection/auditing/event-5069.md
similarity index 100%
rename from windows/device-security/auditing/event-5069.md
rename to windows/security/threat-protection/auditing/event-5069.md
diff --git a/windows/device-security/auditing/event-5070.md b/windows/security/threat-protection/auditing/event-5070.md
similarity index 100%
rename from windows/device-security/auditing/event-5070.md
rename to windows/security/threat-protection/auditing/event-5070.md
diff --git a/windows/device-security/auditing/event-5136.md b/windows/security/threat-protection/auditing/event-5136.md
similarity index 100%
rename from windows/device-security/auditing/event-5136.md
rename to windows/security/threat-protection/auditing/event-5136.md
diff --git a/windows/device-security/auditing/event-5137.md b/windows/security/threat-protection/auditing/event-5137.md
similarity index 100%
rename from windows/device-security/auditing/event-5137.md
rename to windows/security/threat-protection/auditing/event-5137.md
diff --git a/windows/device-security/auditing/event-5138.md b/windows/security/threat-protection/auditing/event-5138.md
similarity index 100%
rename from windows/device-security/auditing/event-5138.md
rename to windows/security/threat-protection/auditing/event-5138.md
diff --git a/windows/device-security/auditing/event-5139.md b/windows/security/threat-protection/auditing/event-5139.md
similarity index 100%
rename from windows/device-security/auditing/event-5139.md
rename to windows/security/threat-protection/auditing/event-5139.md
diff --git a/windows/device-security/auditing/event-5140.md b/windows/security/threat-protection/auditing/event-5140.md
similarity index 100%
rename from windows/device-security/auditing/event-5140.md
rename to windows/security/threat-protection/auditing/event-5140.md
diff --git a/windows/device-security/auditing/event-5141.md b/windows/security/threat-protection/auditing/event-5141.md
similarity index 100%
rename from windows/device-security/auditing/event-5141.md
rename to windows/security/threat-protection/auditing/event-5141.md
diff --git a/windows/device-security/auditing/event-5142.md b/windows/security/threat-protection/auditing/event-5142.md
similarity index 100%
rename from windows/device-security/auditing/event-5142.md
rename to windows/security/threat-protection/auditing/event-5142.md
diff --git a/windows/device-security/auditing/event-5143.md b/windows/security/threat-protection/auditing/event-5143.md
similarity index 100%
rename from windows/device-security/auditing/event-5143.md
rename to windows/security/threat-protection/auditing/event-5143.md
diff --git a/windows/device-security/auditing/event-5144.md b/windows/security/threat-protection/auditing/event-5144.md
similarity index 100%
rename from windows/device-security/auditing/event-5144.md
rename to windows/security/threat-protection/auditing/event-5144.md
diff --git a/windows/device-security/auditing/event-5145.md b/windows/security/threat-protection/auditing/event-5145.md
similarity index 100%
rename from windows/device-security/auditing/event-5145.md
rename to windows/security/threat-protection/auditing/event-5145.md
diff --git a/windows/device-security/auditing/event-5148.md b/windows/security/threat-protection/auditing/event-5148.md
similarity index 100%
rename from windows/device-security/auditing/event-5148.md
rename to windows/security/threat-protection/auditing/event-5148.md
diff --git a/windows/device-security/auditing/event-5149.md b/windows/security/threat-protection/auditing/event-5149.md
similarity index 100%
rename from windows/device-security/auditing/event-5149.md
rename to windows/security/threat-protection/auditing/event-5149.md
diff --git a/windows/device-security/auditing/event-5150.md b/windows/security/threat-protection/auditing/event-5150.md
similarity index 100%
rename from windows/device-security/auditing/event-5150.md
rename to windows/security/threat-protection/auditing/event-5150.md
diff --git a/windows/device-security/auditing/event-5151.md b/windows/security/threat-protection/auditing/event-5151.md
similarity index 100%
rename from windows/device-security/auditing/event-5151.md
rename to windows/security/threat-protection/auditing/event-5151.md
diff --git a/windows/device-security/auditing/event-5152.md b/windows/security/threat-protection/auditing/event-5152.md
similarity index 100%
rename from windows/device-security/auditing/event-5152.md
rename to windows/security/threat-protection/auditing/event-5152.md
diff --git a/windows/device-security/auditing/event-5153.md b/windows/security/threat-protection/auditing/event-5153.md
similarity index 100%
rename from windows/device-security/auditing/event-5153.md
rename to windows/security/threat-protection/auditing/event-5153.md
diff --git a/windows/device-security/auditing/event-5154.md b/windows/security/threat-protection/auditing/event-5154.md
similarity index 100%
rename from windows/device-security/auditing/event-5154.md
rename to windows/security/threat-protection/auditing/event-5154.md
diff --git a/windows/device-security/auditing/event-5155.md b/windows/security/threat-protection/auditing/event-5155.md
similarity index 100%
rename from windows/device-security/auditing/event-5155.md
rename to windows/security/threat-protection/auditing/event-5155.md
diff --git a/windows/device-security/auditing/event-5156.md b/windows/security/threat-protection/auditing/event-5156.md
similarity index 100%
rename from windows/device-security/auditing/event-5156.md
rename to windows/security/threat-protection/auditing/event-5156.md
diff --git a/windows/device-security/auditing/event-5157.md b/windows/security/threat-protection/auditing/event-5157.md
similarity index 100%
rename from windows/device-security/auditing/event-5157.md
rename to windows/security/threat-protection/auditing/event-5157.md
diff --git a/windows/device-security/auditing/event-5158.md b/windows/security/threat-protection/auditing/event-5158.md
similarity index 100%
rename from windows/device-security/auditing/event-5158.md
rename to windows/security/threat-protection/auditing/event-5158.md
diff --git a/windows/device-security/auditing/event-5159.md b/windows/security/threat-protection/auditing/event-5159.md
similarity index 100%
rename from windows/device-security/auditing/event-5159.md
rename to windows/security/threat-protection/auditing/event-5159.md
diff --git a/windows/device-security/auditing/event-5168.md b/windows/security/threat-protection/auditing/event-5168.md
similarity index 100%
rename from windows/device-security/auditing/event-5168.md
rename to windows/security/threat-protection/auditing/event-5168.md
diff --git a/windows/device-security/auditing/event-5376.md b/windows/security/threat-protection/auditing/event-5376.md
similarity index 100%
rename from windows/device-security/auditing/event-5376.md
rename to windows/security/threat-protection/auditing/event-5376.md
diff --git a/windows/device-security/auditing/event-5377.md b/windows/security/threat-protection/auditing/event-5377.md
similarity index 100%
rename from windows/device-security/auditing/event-5377.md
rename to windows/security/threat-protection/auditing/event-5377.md
diff --git a/windows/device-security/auditing/event-5378.md b/windows/security/threat-protection/auditing/event-5378.md
similarity index 100%
rename from windows/device-security/auditing/event-5378.md
rename to windows/security/threat-protection/auditing/event-5378.md
diff --git a/windows/device-security/auditing/event-5447.md b/windows/security/threat-protection/auditing/event-5447.md
similarity index 100%
rename from windows/device-security/auditing/event-5447.md
rename to windows/security/threat-protection/auditing/event-5447.md
diff --git a/windows/device-security/auditing/event-5632.md b/windows/security/threat-protection/auditing/event-5632.md
similarity index 100%
rename from windows/device-security/auditing/event-5632.md
rename to windows/security/threat-protection/auditing/event-5632.md
diff --git a/windows/device-security/auditing/event-5633.md b/windows/security/threat-protection/auditing/event-5633.md
similarity index 100%
rename from windows/device-security/auditing/event-5633.md
rename to windows/security/threat-protection/auditing/event-5633.md
diff --git a/windows/device-security/auditing/event-5712.md b/windows/security/threat-protection/auditing/event-5712.md
similarity index 100%
rename from windows/device-security/auditing/event-5712.md
rename to windows/security/threat-protection/auditing/event-5712.md
diff --git a/windows/device-security/auditing/event-5888.md b/windows/security/threat-protection/auditing/event-5888.md
similarity index 100%
rename from windows/device-security/auditing/event-5888.md
rename to windows/security/threat-protection/auditing/event-5888.md
diff --git a/windows/device-security/auditing/event-5889.md b/windows/security/threat-protection/auditing/event-5889.md
similarity index 100%
rename from windows/device-security/auditing/event-5889.md
rename to windows/security/threat-protection/auditing/event-5889.md
diff --git a/windows/device-security/auditing/event-5890.md b/windows/security/threat-protection/auditing/event-5890.md
similarity index 100%
rename from windows/device-security/auditing/event-5890.md
rename to windows/security/threat-protection/auditing/event-5890.md
diff --git a/windows/device-security/auditing/event-6144.md b/windows/security/threat-protection/auditing/event-6144.md
similarity index 100%
rename from windows/device-security/auditing/event-6144.md
rename to windows/security/threat-protection/auditing/event-6144.md
diff --git a/windows/device-security/auditing/event-6145.md b/windows/security/threat-protection/auditing/event-6145.md
similarity index 100%
rename from windows/device-security/auditing/event-6145.md
rename to windows/security/threat-protection/auditing/event-6145.md
diff --git a/windows/device-security/auditing/event-6281.md b/windows/security/threat-protection/auditing/event-6281.md
similarity index 100%
rename from windows/device-security/auditing/event-6281.md
rename to windows/security/threat-protection/auditing/event-6281.md
diff --git a/windows/device-security/auditing/event-6400.md b/windows/security/threat-protection/auditing/event-6400.md
similarity index 100%
rename from windows/device-security/auditing/event-6400.md
rename to windows/security/threat-protection/auditing/event-6400.md
diff --git a/windows/device-security/auditing/event-6401.md b/windows/security/threat-protection/auditing/event-6401.md
similarity index 100%
rename from windows/device-security/auditing/event-6401.md
rename to windows/security/threat-protection/auditing/event-6401.md
diff --git a/windows/device-security/auditing/event-6402.md b/windows/security/threat-protection/auditing/event-6402.md
similarity index 100%
rename from windows/device-security/auditing/event-6402.md
rename to windows/security/threat-protection/auditing/event-6402.md
diff --git a/windows/device-security/auditing/event-6403.md b/windows/security/threat-protection/auditing/event-6403.md
similarity index 100%
rename from windows/device-security/auditing/event-6403.md
rename to windows/security/threat-protection/auditing/event-6403.md
diff --git a/windows/device-security/auditing/event-6404.md b/windows/security/threat-protection/auditing/event-6404.md
similarity index 100%
rename from windows/device-security/auditing/event-6404.md
rename to windows/security/threat-protection/auditing/event-6404.md
diff --git a/windows/device-security/auditing/event-6405.md b/windows/security/threat-protection/auditing/event-6405.md
similarity index 100%
rename from windows/device-security/auditing/event-6405.md
rename to windows/security/threat-protection/auditing/event-6405.md
diff --git a/windows/device-security/auditing/event-6406.md b/windows/security/threat-protection/auditing/event-6406.md
similarity index 100%
rename from windows/device-security/auditing/event-6406.md
rename to windows/security/threat-protection/auditing/event-6406.md
diff --git a/windows/device-security/auditing/event-6407.md b/windows/security/threat-protection/auditing/event-6407.md
similarity index 100%
rename from windows/device-security/auditing/event-6407.md
rename to windows/security/threat-protection/auditing/event-6407.md
diff --git a/windows/device-security/auditing/event-6408.md b/windows/security/threat-protection/auditing/event-6408.md
similarity index 100%
rename from windows/device-security/auditing/event-6408.md
rename to windows/security/threat-protection/auditing/event-6408.md
diff --git a/windows/device-security/auditing/event-6409.md b/windows/security/threat-protection/auditing/event-6409.md
similarity index 100%
rename from windows/device-security/auditing/event-6409.md
rename to windows/security/threat-protection/auditing/event-6409.md
diff --git a/windows/device-security/auditing/event-6410.md b/windows/security/threat-protection/auditing/event-6410.md
similarity index 100%
rename from windows/device-security/auditing/event-6410.md
rename to windows/security/threat-protection/auditing/event-6410.md
diff --git a/windows/device-security/auditing/event-6416.md b/windows/security/threat-protection/auditing/event-6416.md
similarity index 100%
rename from windows/device-security/auditing/event-6416.md
rename to windows/security/threat-protection/auditing/event-6416.md
diff --git a/windows/device-security/auditing/event-6419.md b/windows/security/threat-protection/auditing/event-6419.md
similarity index 100%
rename from windows/device-security/auditing/event-6419.md
rename to windows/security/threat-protection/auditing/event-6419.md
diff --git a/windows/device-security/auditing/event-6420.md b/windows/security/threat-protection/auditing/event-6420.md
similarity index 100%
rename from windows/device-security/auditing/event-6420.md
rename to windows/security/threat-protection/auditing/event-6420.md
diff --git a/windows/device-security/auditing/event-6421.md b/windows/security/threat-protection/auditing/event-6421.md
similarity index 100%
rename from windows/device-security/auditing/event-6421.md
rename to windows/security/threat-protection/auditing/event-6421.md
diff --git a/windows/device-security/auditing/event-6422.md b/windows/security/threat-protection/auditing/event-6422.md
similarity index 100%
rename from windows/device-security/auditing/event-6422.md
rename to windows/security/threat-protection/auditing/event-6422.md
diff --git a/windows/device-security/auditing/event-6423.md b/windows/security/threat-protection/auditing/event-6423.md
similarity index 100%
rename from windows/device-security/auditing/event-6423.md
rename to windows/security/threat-protection/auditing/event-6423.md
diff --git a/windows/device-security/auditing/event-6424.md b/windows/security/threat-protection/auditing/event-6424.md
similarity index 100%
rename from windows/device-security/auditing/event-6424.md
rename to windows/security/threat-protection/auditing/event-6424.md
diff --git a/windows/device-security/auditing/file-system-global-object-access-auditing.md b/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md
similarity index 100%
rename from windows/device-security/auditing/file-system-global-object-access-auditing.md
rename to windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md
diff --git a/windows/device-security/auditing/images/ad-sites-and-services.png b/windows/security/threat-protection/auditing/images/ad-sites-and-services.png
similarity index 100%
rename from windows/device-security/auditing/images/ad-sites-and-services.png
rename to windows/security/threat-protection/auditing/images/ad-sites-and-services.png
diff --git a/windows/device-security/auditing/images/advanced-sharing.png b/windows/security/threat-protection/auditing/images/advanced-sharing.png
similarity index 100%
rename from windows/device-security/auditing/images/advanced-sharing.png
rename to windows/security/threat-protection/auditing/images/advanced-sharing.png
diff --git a/windows/device-security/auditing/images/auditpol-list-subcategory.png b/windows/security/threat-protection/auditing/images/auditpol-list-subcategory.png
similarity index 100%
rename from windows/device-security/auditing/images/auditpol-list-subcategory.png
rename to windows/security/threat-protection/auditing/images/auditpol-list-subcategory.png
diff --git a/windows/device-security/auditing/images/auditpol-list-user.png b/windows/security/threat-protection/auditing/images/auditpol-list-user.png
similarity index 100%
rename from windows/device-security/auditing/images/auditpol-list-user.png
rename to windows/security/threat-protection/auditing/images/auditpol-list-user.png
diff --git a/windows/device-security/auditing/images/branchcache-properties.png b/windows/security/threat-protection/auditing/images/branchcache-properties.png
similarity index 100%
rename from windows/device-security/auditing/images/branchcache-properties.png
rename to windows/security/threat-protection/auditing/images/branchcache-properties.png
diff --git a/windows/device-security/auditing/images/certutil-command.png b/windows/security/threat-protection/auditing/images/certutil-command.png
similarity index 100%
rename from windows/device-security/auditing/images/certutil-command.png
rename to windows/security/threat-protection/auditing/images/certutil-command.png
diff --git a/windows/device-security/auditing/images/computer-management.png b/windows/security/threat-protection/auditing/images/computer-management.png
similarity index 100%
rename from windows/device-security/auditing/images/computer-management.png
rename to windows/security/threat-protection/auditing/images/computer-management.png
diff --git a/windows/device-security/auditing/images/diskpart.png b/windows/security/threat-protection/auditing/images/diskpart.png
similarity index 100%
rename from windows/device-security/auditing/images/diskpart.png
rename to windows/security/threat-protection/auditing/images/diskpart.png
diff --git a/windows/device-security/auditing/images/event-1100.png b/windows/security/threat-protection/auditing/images/event-1100.png
similarity index 100%
rename from windows/device-security/auditing/images/event-1100.png
rename to windows/security/threat-protection/auditing/images/event-1100.png
diff --git a/windows/device-security/auditing/images/event-1102.png b/windows/security/threat-protection/auditing/images/event-1102.png
similarity index 100%
rename from windows/device-security/auditing/images/event-1102.png
rename to windows/security/threat-protection/auditing/images/event-1102.png
diff --git a/windows/device-security/auditing/images/event-1104.png b/windows/security/threat-protection/auditing/images/event-1104.png
similarity index 100%
rename from windows/device-security/auditing/images/event-1104.png
rename to windows/security/threat-protection/auditing/images/event-1104.png
diff --git a/windows/device-security/auditing/images/event-1105.png b/windows/security/threat-protection/auditing/images/event-1105.png
similarity index 100%
rename from windows/device-security/auditing/images/event-1105.png
rename to windows/security/threat-protection/auditing/images/event-1105.png
diff --git a/windows/device-security/auditing/images/event-1108.png b/windows/security/threat-protection/auditing/images/event-1108.png
similarity index 100%
rename from windows/device-security/auditing/images/event-1108.png
rename to windows/security/threat-protection/auditing/images/event-1108.png
diff --git a/windows/device-security/auditing/images/event-4608.png b/windows/security/threat-protection/auditing/images/event-4608.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4608.png
rename to windows/security/threat-protection/auditing/images/event-4608.png
diff --git a/windows/device-security/auditing/images/event-4610.png b/windows/security/threat-protection/auditing/images/event-4610.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4610.png
rename to windows/security/threat-protection/auditing/images/event-4610.png
diff --git a/windows/device-security/auditing/images/event-4611.png b/windows/security/threat-protection/auditing/images/event-4611.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4611.png
rename to windows/security/threat-protection/auditing/images/event-4611.png
diff --git a/windows/device-security/auditing/images/event-4614.png b/windows/security/threat-protection/auditing/images/event-4614.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4614.png
rename to windows/security/threat-protection/auditing/images/event-4614.png
diff --git a/windows/device-security/auditing/images/event-4616.png b/windows/security/threat-protection/auditing/images/event-4616.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4616.png
rename to windows/security/threat-protection/auditing/images/event-4616.png
diff --git a/windows/device-security/auditing/images/event-4618.png b/windows/security/threat-protection/auditing/images/event-4618.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4618.png
rename to windows/security/threat-protection/auditing/images/event-4618.png
diff --git a/windows/device-security/auditing/images/event-4622.png b/windows/security/threat-protection/auditing/images/event-4622.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4622.png
rename to windows/security/threat-protection/auditing/images/event-4622.png
diff --git a/windows/device-security/auditing/images/event-4624.png b/windows/security/threat-protection/auditing/images/event-4624.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4624.png
rename to windows/security/threat-protection/auditing/images/event-4624.png
diff --git a/windows/device-security/auditing/images/event-4625.png b/windows/security/threat-protection/auditing/images/event-4625.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4625.png
rename to windows/security/threat-protection/auditing/images/event-4625.png
diff --git a/windows/device-security/auditing/images/event-4626.png b/windows/security/threat-protection/auditing/images/event-4626.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4626.png
rename to windows/security/threat-protection/auditing/images/event-4626.png
diff --git a/windows/device-security/auditing/images/event-4627.png b/windows/security/threat-protection/auditing/images/event-4627.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4627.png
rename to windows/security/threat-protection/auditing/images/event-4627.png
diff --git a/windows/device-security/auditing/images/event-4634.png b/windows/security/threat-protection/auditing/images/event-4634.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4634.png
rename to windows/security/threat-protection/auditing/images/event-4634.png
diff --git a/windows/device-security/auditing/images/event-4647.png b/windows/security/threat-protection/auditing/images/event-4647.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4647.png
rename to windows/security/threat-protection/auditing/images/event-4647.png
diff --git a/windows/device-security/auditing/images/event-4648.png b/windows/security/threat-protection/auditing/images/event-4648.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4648.png
rename to windows/security/threat-protection/auditing/images/event-4648.png
diff --git a/windows/device-security/auditing/images/event-4656.png b/windows/security/threat-protection/auditing/images/event-4656.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4656.png
rename to windows/security/threat-protection/auditing/images/event-4656.png
diff --git a/windows/device-security/auditing/images/event-4657.png b/windows/security/threat-protection/auditing/images/event-4657.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4657.png
rename to windows/security/threat-protection/auditing/images/event-4657.png
diff --git a/windows/device-security/auditing/images/event-4658.png b/windows/security/threat-protection/auditing/images/event-4658.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4658.png
rename to windows/security/threat-protection/auditing/images/event-4658.png
diff --git a/windows/device-security/auditing/images/event-4660.png b/windows/security/threat-protection/auditing/images/event-4660.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4660.png
rename to windows/security/threat-protection/auditing/images/event-4660.png
diff --git a/windows/device-security/auditing/images/event-4661.png b/windows/security/threat-protection/auditing/images/event-4661.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4661.png
rename to windows/security/threat-protection/auditing/images/event-4661.png
diff --git a/windows/device-security/auditing/images/event-4662.png b/windows/security/threat-protection/auditing/images/event-4662.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4662.png
rename to windows/security/threat-protection/auditing/images/event-4662.png
diff --git a/windows/device-security/auditing/images/event-4663.png b/windows/security/threat-protection/auditing/images/event-4663.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4663.png
rename to windows/security/threat-protection/auditing/images/event-4663.png
diff --git a/windows/device-security/auditing/images/event-4664.png b/windows/security/threat-protection/auditing/images/event-4664.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4664.png
rename to windows/security/threat-protection/auditing/images/event-4664.png
diff --git a/windows/device-security/auditing/images/event-4670.png b/windows/security/threat-protection/auditing/images/event-4670.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4670.png
rename to windows/security/threat-protection/auditing/images/event-4670.png
diff --git a/windows/device-security/auditing/images/event-4672.png b/windows/security/threat-protection/auditing/images/event-4672.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4672.png
rename to windows/security/threat-protection/auditing/images/event-4672.png
diff --git a/windows/device-security/auditing/images/event-4673.png b/windows/security/threat-protection/auditing/images/event-4673.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4673.png
rename to windows/security/threat-protection/auditing/images/event-4673.png
diff --git a/windows/device-security/auditing/images/event-4674.png b/windows/security/threat-protection/auditing/images/event-4674.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4674.png
rename to windows/security/threat-protection/auditing/images/event-4674.png
diff --git a/windows/device-security/auditing/images/event-4688.png b/windows/security/threat-protection/auditing/images/event-4688.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4688.png
rename to windows/security/threat-protection/auditing/images/event-4688.png
diff --git a/windows/device-security/auditing/images/event-4689.png b/windows/security/threat-protection/auditing/images/event-4689.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4689.png
rename to windows/security/threat-protection/auditing/images/event-4689.png
diff --git a/windows/device-security/auditing/images/event-4690.png b/windows/security/threat-protection/auditing/images/event-4690.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4690.png
rename to windows/security/threat-protection/auditing/images/event-4690.png
diff --git a/windows/device-security/auditing/images/event-4691.png b/windows/security/threat-protection/auditing/images/event-4691.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4691.png
rename to windows/security/threat-protection/auditing/images/event-4691.png
diff --git a/windows/device-security/auditing/images/event-4692.png b/windows/security/threat-protection/auditing/images/event-4692.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4692.png
rename to windows/security/threat-protection/auditing/images/event-4692.png
diff --git a/windows/device-security/auditing/images/event-4693.png b/windows/security/threat-protection/auditing/images/event-4693.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4693.png
rename to windows/security/threat-protection/auditing/images/event-4693.png
diff --git a/windows/device-security/auditing/images/event-4696.png b/windows/security/threat-protection/auditing/images/event-4696.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4696.png
rename to windows/security/threat-protection/auditing/images/event-4696.png
diff --git a/windows/device-security/auditing/images/event-4697.png b/windows/security/threat-protection/auditing/images/event-4697.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4697.png
rename to windows/security/threat-protection/auditing/images/event-4697.png
diff --git a/windows/device-security/auditing/images/event-4698.png b/windows/security/threat-protection/auditing/images/event-4698.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4698.png
rename to windows/security/threat-protection/auditing/images/event-4698.png
diff --git a/windows/device-security/auditing/images/event-4699.png b/windows/security/threat-protection/auditing/images/event-4699.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4699.png
rename to windows/security/threat-protection/auditing/images/event-4699.png
diff --git a/windows/device-security/auditing/images/event-4700.png b/windows/security/threat-protection/auditing/images/event-4700.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4700.png
rename to windows/security/threat-protection/auditing/images/event-4700.png
diff --git a/windows/device-security/auditing/images/event-4701.png b/windows/security/threat-protection/auditing/images/event-4701.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4701.png
rename to windows/security/threat-protection/auditing/images/event-4701.png
diff --git a/windows/device-security/auditing/images/event-4702.png b/windows/security/threat-protection/auditing/images/event-4702.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4702.png
rename to windows/security/threat-protection/auditing/images/event-4702.png
diff --git a/windows/device-security/auditing/images/event-4703-partial.png b/windows/security/threat-protection/auditing/images/event-4703-partial.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4703-partial.png
rename to windows/security/threat-protection/auditing/images/event-4703-partial.png
diff --git a/windows/device-security/auditing/images/event-4703.png b/windows/security/threat-protection/auditing/images/event-4703.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4703.png
rename to windows/security/threat-protection/auditing/images/event-4703.png
diff --git a/windows/device-security/auditing/images/event-4704.png b/windows/security/threat-protection/auditing/images/event-4704.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4704.png
rename to windows/security/threat-protection/auditing/images/event-4704.png
diff --git a/windows/device-security/auditing/images/event-4705.png b/windows/security/threat-protection/auditing/images/event-4705.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4705.png
rename to windows/security/threat-protection/auditing/images/event-4705.png
diff --git a/windows/device-security/auditing/images/event-4706.png b/windows/security/threat-protection/auditing/images/event-4706.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4706.png
rename to windows/security/threat-protection/auditing/images/event-4706.png
diff --git a/windows/device-security/auditing/images/event-4707.png b/windows/security/threat-protection/auditing/images/event-4707.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4707.png
rename to windows/security/threat-protection/auditing/images/event-4707.png
diff --git a/windows/device-security/auditing/images/event-4713.png b/windows/security/threat-protection/auditing/images/event-4713.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4713.png
rename to windows/security/threat-protection/auditing/images/event-4713.png
diff --git a/windows/device-security/auditing/images/event-4714.png b/windows/security/threat-protection/auditing/images/event-4714.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4714.png
rename to windows/security/threat-protection/auditing/images/event-4714.png
diff --git a/windows/device-security/auditing/images/event-4715.png b/windows/security/threat-protection/auditing/images/event-4715.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4715.png
rename to windows/security/threat-protection/auditing/images/event-4715.png
diff --git a/windows/device-security/auditing/images/event-4716.png b/windows/security/threat-protection/auditing/images/event-4716.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4716.png
rename to windows/security/threat-protection/auditing/images/event-4716.png
diff --git a/windows/device-security/auditing/images/event-4717.png b/windows/security/threat-protection/auditing/images/event-4717.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4717.png
rename to windows/security/threat-protection/auditing/images/event-4717.png
diff --git a/windows/device-security/auditing/images/event-4718.png b/windows/security/threat-protection/auditing/images/event-4718.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4718.png
rename to windows/security/threat-protection/auditing/images/event-4718.png
diff --git a/windows/device-security/auditing/images/event-4719.png b/windows/security/threat-protection/auditing/images/event-4719.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4719.png
rename to windows/security/threat-protection/auditing/images/event-4719.png
diff --git a/windows/device-security/auditing/images/event-4720.png b/windows/security/threat-protection/auditing/images/event-4720.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4720.png
rename to windows/security/threat-protection/auditing/images/event-4720.png
diff --git a/windows/device-security/auditing/images/event-4722.png b/windows/security/threat-protection/auditing/images/event-4722.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4722.png
rename to windows/security/threat-protection/auditing/images/event-4722.png
diff --git a/windows/device-security/auditing/images/event-4723.png b/windows/security/threat-protection/auditing/images/event-4723.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4723.png
rename to windows/security/threat-protection/auditing/images/event-4723.png
diff --git a/windows/device-security/auditing/images/event-4724.png b/windows/security/threat-protection/auditing/images/event-4724.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4724.png
rename to windows/security/threat-protection/auditing/images/event-4724.png
diff --git a/windows/device-security/auditing/images/event-4725.png b/windows/security/threat-protection/auditing/images/event-4725.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4725.png
rename to windows/security/threat-protection/auditing/images/event-4725.png
diff --git a/windows/device-security/auditing/images/event-4726.png b/windows/security/threat-protection/auditing/images/event-4726.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4726.png
rename to windows/security/threat-protection/auditing/images/event-4726.png
diff --git a/windows/device-security/auditing/images/event-4731.png b/windows/security/threat-protection/auditing/images/event-4731.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4731.png
rename to windows/security/threat-protection/auditing/images/event-4731.png
diff --git a/windows/device-security/auditing/images/event-4732.png b/windows/security/threat-protection/auditing/images/event-4732.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4732.png
rename to windows/security/threat-protection/auditing/images/event-4732.png
diff --git a/windows/device-security/auditing/images/event-4733.png b/windows/security/threat-protection/auditing/images/event-4733.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4733.png
rename to windows/security/threat-protection/auditing/images/event-4733.png
diff --git a/windows/device-security/auditing/images/event-4734.png b/windows/security/threat-protection/auditing/images/event-4734.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4734.png
rename to windows/security/threat-protection/auditing/images/event-4734.png
diff --git a/windows/device-security/auditing/images/event-4735.png b/windows/security/threat-protection/auditing/images/event-4735.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4735.png
rename to windows/security/threat-protection/auditing/images/event-4735.png
diff --git a/windows/device-security/auditing/images/event-4738.png b/windows/security/threat-protection/auditing/images/event-4738.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4738.png
rename to windows/security/threat-protection/auditing/images/event-4738.png
diff --git a/windows/device-security/auditing/images/event-4739.png b/windows/security/threat-protection/auditing/images/event-4739.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4739.png
rename to windows/security/threat-protection/auditing/images/event-4739.png
diff --git a/windows/device-security/auditing/images/event-4740.png b/windows/security/threat-protection/auditing/images/event-4740.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4740.png
rename to windows/security/threat-protection/auditing/images/event-4740.png
diff --git a/windows/device-security/auditing/images/event-4741.png b/windows/security/threat-protection/auditing/images/event-4741.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4741.png
rename to windows/security/threat-protection/auditing/images/event-4741.png
diff --git a/windows/device-security/auditing/images/event-4742.png b/windows/security/threat-protection/auditing/images/event-4742.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4742.png
rename to windows/security/threat-protection/auditing/images/event-4742.png
diff --git a/windows/device-security/auditing/images/event-4743.png b/windows/security/threat-protection/auditing/images/event-4743.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4743.png
rename to windows/security/threat-protection/auditing/images/event-4743.png
diff --git a/windows/device-security/auditing/images/event-4749.png b/windows/security/threat-protection/auditing/images/event-4749.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4749.png
rename to windows/security/threat-protection/auditing/images/event-4749.png
diff --git a/windows/device-security/auditing/images/event-4750.png b/windows/security/threat-protection/auditing/images/event-4750.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4750.png
rename to windows/security/threat-protection/auditing/images/event-4750.png
diff --git a/windows/device-security/auditing/images/event-4751.png b/windows/security/threat-protection/auditing/images/event-4751.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4751.png
rename to windows/security/threat-protection/auditing/images/event-4751.png
diff --git a/windows/device-security/auditing/images/event-4752.png b/windows/security/threat-protection/auditing/images/event-4752.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4752.png
rename to windows/security/threat-protection/auditing/images/event-4752.png
diff --git a/windows/device-security/auditing/images/event-4753.png b/windows/security/threat-protection/auditing/images/event-4753.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4753.png
rename to windows/security/threat-protection/auditing/images/event-4753.png
diff --git a/windows/device-security/auditing/images/event-4764.png b/windows/security/threat-protection/auditing/images/event-4764.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4764.png
rename to windows/security/threat-protection/auditing/images/event-4764.png
diff --git a/windows/device-security/auditing/images/event-4767.png b/windows/security/threat-protection/auditing/images/event-4767.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4767.png
rename to windows/security/threat-protection/auditing/images/event-4767.png
diff --git a/windows/device-security/auditing/images/event-4768.png b/windows/security/threat-protection/auditing/images/event-4768.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4768.png
rename to windows/security/threat-protection/auditing/images/event-4768.png
diff --git a/windows/device-security/auditing/images/event-4769.png b/windows/security/threat-protection/auditing/images/event-4769.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4769.png
rename to windows/security/threat-protection/auditing/images/event-4769.png
diff --git a/windows/device-security/auditing/images/event-4770.png b/windows/security/threat-protection/auditing/images/event-4770.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4770.png
rename to windows/security/threat-protection/auditing/images/event-4770.png
diff --git a/windows/device-security/auditing/images/event-4771.png b/windows/security/threat-protection/auditing/images/event-4771.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4771.png
rename to windows/security/threat-protection/auditing/images/event-4771.png
diff --git a/windows/device-security/auditing/images/event-4776.png b/windows/security/threat-protection/auditing/images/event-4776.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4776.png
rename to windows/security/threat-protection/auditing/images/event-4776.png
diff --git a/windows/device-security/auditing/images/event-4778.png b/windows/security/threat-protection/auditing/images/event-4778.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4778.png
rename to windows/security/threat-protection/auditing/images/event-4778.png
diff --git a/windows/device-security/auditing/images/event-4779.png b/windows/security/threat-protection/auditing/images/event-4779.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4779.png
rename to windows/security/threat-protection/auditing/images/event-4779.png
diff --git a/windows/device-security/auditing/images/event-4781.png b/windows/security/threat-protection/auditing/images/event-4781.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4781.png
rename to windows/security/threat-protection/auditing/images/event-4781.png
diff --git a/windows/device-security/auditing/images/event-4782.png b/windows/security/threat-protection/auditing/images/event-4782.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4782.png
rename to windows/security/threat-protection/auditing/images/event-4782.png
diff --git a/windows/device-security/auditing/images/event-4793.png b/windows/security/threat-protection/auditing/images/event-4793.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4793.png
rename to windows/security/threat-protection/auditing/images/event-4793.png
diff --git a/windows/device-security/auditing/images/event-4794.png b/windows/security/threat-protection/auditing/images/event-4794.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4794.png
rename to windows/security/threat-protection/auditing/images/event-4794.png
diff --git a/windows/device-security/auditing/images/event-4798.png b/windows/security/threat-protection/auditing/images/event-4798.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4798.png
rename to windows/security/threat-protection/auditing/images/event-4798.png
diff --git a/windows/device-security/auditing/images/event-4799.png b/windows/security/threat-protection/auditing/images/event-4799.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4799.png
rename to windows/security/threat-protection/auditing/images/event-4799.png
diff --git a/windows/device-security/auditing/images/event-4800.png b/windows/security/threat-protection/auditing/images/event-4800.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4800.png
rename to windows/security/threat-protection/auditing/images/event-4800.png
diff --git a/windows/device-security/auditing/images/event-4801.png b/windows/security/threat-protection/auditing/images/event-4801.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4801.png
rename to windows/security/threat-protection/auditing/images/event-4801.png
diff --git a/windows/device-security/auditing/images/event-4802.png b/windows/security/threat-protection/auditing/images/event-4802.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4802.png
rename to windows/security/threat-protection/auditing/images/event-4802.png
diff --git a/windows/device-security/auditing/images/event-4803.png b/windows/security/threat-protection/auditing/images/event-4803.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4803.png
rename to windows/security/threat-protection/auditing/images/event-4803.png
diff --git a/windows/device-security/auditing/images/event-4817.png b/windows/security/threat-protection/auditing/images/event-4817.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4817.png
rename to windows/security/threat-protection/auditing/images/event-4817.png
diff --git a/windows/device-security/auditing/images/event-4818.png b/windows/security/threat-protection/auditing/images/event-4818.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4818.png
rename to windows/security/threat-protection/auditing/images/event-4818.png
diff --git a/windows/device-security/auditing/images/event-4819.png b/windows/security/threat-protection/auditing/images/event-4819.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4819.png
rename to windows/security/threat-protection/auditing/images/event-4819.png
diff --git a/windows/device-security/auditing/images/event-4826.png b/windows/security/threat-protection/auditing/images/event-4826.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4826.png
rename to windows/security/threat-protection/auditing/images/event-4826.png
diff --git a/windows/device-security/auditing/images/event-4865.png b/windows/security/threat-protection/auditing/images/event-4865.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4865.png
rename to windows/security/threat-protection/auditing/images/event-4865.png
diff --git a/windows/device-security/auditing/images/event-4866.png b/windows/security/threat-protection/auditing/images/event-4866.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4866.png
rename to windows/security/threat-protection/auditing/images/event-4866.png
diff --git a/windows/device-security/auditing/images/event-4867.png b/windows/security/threat-protection/auditing/images/event-4867.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4867.png
rename to windows/security/threat-protection/auditing/images/event-4867.png
diff --git a/windows/device-security/auditing/images/event-4902.png b/windows/security/threat-protection/auditing/images/event-4902.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4902.png
rename to windows/security/threat-protection/auditing/images/event-4902.png
diff --git a/windows/device-security/auditing/images/event-4904.png b/windows/security/threat-protection/auditing/images/event-4904.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4904.png
rename to windows/security/threat-protection/auditing/images/event-4904.png
diff --git a/windows/device-security/auditing/images/event-4905.png b/windows/security/threat-protection/auditing/images/event-4905.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4905.png
rename to windows/security/threat-protection/auditing/images/event-4905.png
diff --git a/windows/device-security/auditing/images/event-4906.png b/windows/security/threat-protection/auditing/images/event-4906.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4906.png
rename to windows/security/threat-protection/auditing/images/event-4906.png
diff --git a/windows/device-security/auditing/images/event-4907.png b/windows/security/threat-protection/auditing/images/event-4907.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4907.png
rename to windows/security/threat-protection/auditing/images/event-4907.png
diff --git a/windows/device-security/auditing/images/event-4908.png b/windows/security/threat-protection/auditing/images/event-4908.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4908.png
rename to windows/security/threat-protection/auditing/images/event-4908.png
diff --git a/windows/device-security/auditing/images/event-4911.png b/windows/security/threat-protection/auditing/images/event-4911.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4911.png
rename to windows/security/threat-protection/auditing/images/event-4911.png
diff --git a/windows/device-security/auditing/images/event-4912.png b/windows/security/threat-protection/auditing/images/event-4912.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4912.png
rename to windows/security/threat-protection/auditing/images/event-4912.png
diff --git a/windows/device-security/auditing/images/event-4913.png b/windows/security/threat-protection/auditing/images/event-4913.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4913.png
rename to windows/security/threat-protection/auditing/images/event-4913.png
diff --git a/windows/device-security/auditing/images/event-4928.png b/windows/security/threat-protection/auditing/images/event-4928.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4928.png
rename to windows/security/threat-protection/auditing/images/event-4928.png
diff --git a/windows/device-security/auditing/images/event-4929.png b/windows/security/threat-protection/auditing/images/event-4929.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4929.png
rename to windows/security/threat-protection/auditing/images/event-4929.png
diff --git a/windows/device-security/auditing/images/event-4930.png b/windows/security/threat-protection/auditing/images/event-4930.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4930.png
rename to windows/security/threat-protection/auditing/images/event-4930.png
diff --git a/windows/device-security/auditing/images/event-4931.png b/windows/security/threat-protection/auditing/images/event-4931.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4931.png
rename to windows/security/threat-protection/auditing/images/event-4931.png
diff --git a/windows/device-security/auditing/images/event-4932.png b/windows/security/threat-protection/auditing/images/event-4932.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4932.png
rename to windows/security/threat-protection/auditing/images/event-4932.png
diff --git a/windows/device-security/auditing/images/event-4933.png b/windows/security/threat-protection/auditing/images/event-4933.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4933.png
rename to windows/security/threat-protection/auditing/images/event-4933.png
diff --git a/windows/device-security/auditing/images/event-4935.png b/windows/security/threat-protection/auditing/images/event-4935.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4935.png
rename to windows/security/threat-protection/auditing/images/event-4935.png
diff --git a/windows/device-security/auditing/images/event-4944.png b/windows/security/threat-protection/auditing/images/event-4944.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4944.png
rename to windows/security/threat-protection/auditing/images/event-4944.png
diff --git a/windows/device-security/auditing/images/event-4945.png b/windows/security/threat-protection/auditing/images/event-4945.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4945.png
rename to windows/security/threat-protection/auditing/images/event-4945.png
diff --git a/windows/device-security/auditing/images/event-4946.png b/windows/security/threat-protection/auditing/images/event-4946.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4946.png
rename to windows/security/threat-protection/auditing/images/event-4946.png
diff --git a/windows/device-security/auditing/images/event-4947.png b/windows/security/threat-protection/auditing/images/event-4947.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4947.png
rename to windows/security/threat-protection/auditing/images/event-4947.png
diff --git a/windows/device-security/auditing/images/event-4948.png b/windows/security/threat-protection/auditing/images/event-4948.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4948.png
rename to windows/security/threat-protection/auditing/images/event-4948.png
diff --git a/windows/device-security/auditing/images/event-4949.png b/windows/security/threat-protection/auditing/images/event-4949.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4949.png
rename to windows/security/threat-protection/auditing/images/event-4949.png
diff --git a/windows/device-security/auditing/images/event-4950.png b/windows/security/threat-protection/auditing/images/event-4950.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4950.png
rename to windows/security/threat-protection/auditing/images/event-4950.png
diff --git a/windows/device-security/auditing/images/event-4951.png b/windows/security/threat-protection/auditing/images/event-4951.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4951.png
rename to windows/security/threat-protection/auditing/images/event-4951.png
diff --git a/windows/device-security/auditing/images/event-4953.png b/windows/security/threat-protection/auditing/images/event-4953.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4953.png
rename to windows/security/threat-protection/auditing/images/event-4953.png
diff --git a/windows/device-security/auditing/images/event-4954.png b/windows/security/threat-protection/auditing/images/event-4954.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4954.png
rename to windows/security/threat-protection/auditing/images/event-4954.png
diff --git a/windows/device-security/auditing/images/event-4956.png b/windows/security/threat-protection/auditing/images/event-4956.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4956.png
rename to windows/security/threat-protection/auditing/images/event-4956.png
diff --git a/windows/device-security/auditing/images/event-4957.png b/windows/security/threat-protection/auditing/images/event-4957.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4957.png
rename to windows/security/threat-protection/auditing/images/event-4957.png
diff --git a/windows/device-security/auditing/images/event-4964.png b/windows/security/threat-protection/auditing/images/event-4964.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4964.png
rename to windows/security/threat-protection/auditing/images/event-4964.png
diff --git a/windows/device-security/auditing/images/event-4985.png b/windows/security/threat-protection/auditing/images/event-4985.png
similarity index 100%
rename from windows/device-security/auditing/images/event-4985.png
rename to windows/security/threat-protection/auditing/images/event-4985.png
diff --git a/windows/device-security/auditing/images/event-5024.png b/windows/security/threat-protection/auditing/images/event-5024.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5024.png
rename to windows/security/threat-protection/auditing/images/event-5024.png
diff --git a/windows/device-security/auditing/images/event-5025.png b/windows/security/threat-protection/auditing/images/event-5025.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5025.png
rename to windows/security/threat-protection/auditing/images/event-5025.png
diff --git a/windows/device-security/auditing/images/event-5027.png b/windows/security/threat-protection/auditing/images/event-5027.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5027.png
rename to windows/security/threat-protection/auditing/images/event-5027.png
diff --git a/windows/device-security/auditing/images/event-5028.png b/windows/security/threat-protection/auditing/images/event-5028.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5028.png
rename to windows/security/threat-protection/auditing/images/event-5028.png
diff --git a/windows/device-security/auditing/images/event-5031.png b/windows/security/threat-protection/auditing/images/event-5031.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5031.png
rename to windows/security/threat-protection/auditing/images/event-5031.png
diff --git a/windows/device-security/auditing/images/event-5033.png b/windows/security/threat-protection/auditing/images/event-5033.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5033.png
rename to windows/security/threat-protection/auditing/images/event-5033.png
diff --git a/windows/device-security/auditing/images/event-5034.png b/windows/security/threat-protection/auditing/images/event-5034.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5034.png
rename to windows/security/threat-protection/auditing/images/event-5034.png
diff --git a/windows/device-security/auditing/images/event-5058.png b/windows/security/threat-protection/auditing/images/event-5058.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5058.png
rename to windows/security/threat-protection/auditing/images/event-5058.png
diff --git a/windows/device-security/auditing/images/event-5059.png b/windows/security/threat-protection/auditing/images/event-5059.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5059.png
rename to windows/security/threat-protection/auditing/images/event-5059.png
diff --git a/windows/device-security/auditing/images/event-5061.png b/windows/security/threat-protection/auditing/images/event-5061.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5061.png
rename to windows/security/threat-protection/auditing/images/event-5061.png
diff --git a/windows/device-security/auditing/images/event-5136.png b/windows/security/threat-protection/auditing/images/event-5136.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5136.png
rename to windows/security/threat-protection/auditing/images/event-5136.png
diff --git a/windows/device-security/auditing/images/event-5137.png b/windows/security/threat-protection/auditing/images/event-5137.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5137.png
rename to windows/security/threat-protection/auditing/images/event-5137.png
diff --git a/windows/device-security/auditing/images/event-5138.png b/windows/security/threat-protection/auditing/images/event-5138.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5138.png
rename to windows/security/threat-protection/auditing/images/event-5138.png
diff --git a/windows/device-security/auditing/images/event-5139.png b/windows/security/threat-protection/auditing/images/event-5139.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5139.png
rename to windows/security/threat-protection/auditing/images/event-5139.png
diff --git a/windows/device-security/auditing/images/event-5140.png b/windows/security/threat-protection/auditing/images/event-5140.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5140.png
rename to windows/security/threat-protection/auditing/images/event-5140.png
diff --git a/windows/device-security/auditing/images/event-5141.png b/windows/security/threat-protection/auditing/images/event-5141.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5141.png
rename to windows/security/threat-protection/auditing/images/event-5141.png
diff --git a/windows/device-security/auditing/images/event-5142.png b/windows/security/threat-protection/auditing/images/event-5142.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5142.png
rename to windows/security/threat-protection/auditing/images/event-5142.png
diff --git a/windows/device-security/auditing/images/event-5143.png b/windows/security/threat-protection/auditing/images/event-5143.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5143.png
rename to windows/security/threat-protection/auditing/images/event-5143.png
diff --git a/windows/device-security/auditing/images/event-5144.png b/windows/security/threat-protection/auditing/images/event-5144.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5144.png
rename to windows/security/threat-protection/auditing/images/event-5144.png
diff --git a/windows/device-security/auditing/images/event-5145.png b/windows/security/threat-protection/auditing/images/event-5145.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5145.png
rename to windows/security/threat-protection/auditing/images/event-5145.png
diff --git a/windows/device-security/auditing/images/event-5152.png b/windows/security/threat-protection/auditing/images/event-5152.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5152.png
rename to windows/security/threat-protection/auditing/images/event-5152.png
diff --git a/windows/device-security/auditing/images/event-5154.png b/windows/security/threat-protection/auditing/images/event-5154.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5154.png
rename to windows/security/threat-protection/auditing/images/event-5154.png
diff --git a/windows/device-security/auditing/images/event-5156.png b/windows/security/threat-protection/auditing/images/event-5156.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5156.png
rename to windows/security/threat-protection/auditing/images/event-5156.png
diff --git a/windows/device-security/auditing/images/event-5157.png b/windows/security/threat-protection/auditing/images/event-5157.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5157.png
rename to windows/security/threat-protection/auditing/images/event-5157.png
diff --git a/windows/device-security/auditing/images/event-5158.png b/windows/security/threat-protection/auditing/images/event-5158.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5158.png
rename to windows/security/threat-protection/auditing/images/event-5158.png
diff --git a/windows/device-security/auditing/images/event-5168.png b/windows/security/threat-protection/auditing/images/event-5168.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5168.png
rename to windows/security/threat-protection/auditing/images/event-5168.png
diff --git a/windows/device-security/auditing/images/event-5376.png b/windows/security/threat-protection/auditing/images/event-5376.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5376.png
rename to windows/security/threat-protection/auditing/images/event-5376.png
diff --git a/windows/device-security/auditing/images/event-5377.png b/windows/security/threat-protection/auditing/images/event-5377.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5377.png
rename to windows/security/threat-protection/auditing/images/event-5377.png
diff --git a/windows/device-security/auditing/images/event-5378.png b/windows/security/threat-protection/auditing/images/event-5378.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5378.png
rename to windows/security/threat-protection/auditing/images/event-5378.png
diff --git a/windows/device-security/auditing/images/event-5447.png b/windows/security/threat-protection/auditing/images/event-5447.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5447.png
rename to windows/security/threat-protection/auditing/images/event-5447.png
diff --git a/windows/device-security/auditing/images/event-5632.png b/windows/security/threat-protection/auditing/images/event-5632.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5632.png
rename to windows/security/threat-protection/auditing/images/event-5632.png
diff --git a/windows/device-security/auditing/images/event-5633.png b/windows/security/threat-protection/auditing/images/event-5633.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5633.png
rename to windows/security/threat-protection/auditing/images/event-5633.png
diff --git a/windows/device-security/auditing/images/event-5888.png b/windows/security/threat-protection/auditing/images/event-5888.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5888.png
rename to windows/security/threat-protection/auditing/images/event-5888.png
diff --git a/windows/device-security/auditing/images/event-5889.png b/windows/security/threat-protection/auditing/images/event-5889.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5889.png
rename to windows/security/threat-protection/auditing/images/event-5889.png
diff --git a/windows/device-security/auditing/images/event-5890.png b/windows/security/threat-protection/auditing/images/event-5890.png
similarity index 100%
rename from windows/device-security/auditing/images/event-5890.png
rename to windows/security/threat-protection/auditing/images/event-5890.png
diff --git a/windows/device-security/auditing/images/event-6144.png b/windows/security/threat-protection/auditing/images/event-6144.png
similarity index 100%
rename from windows/device-security/auditing/images/event-6144.png
rename to windows/security/threat-protection/auditing/images/event-6144.png
diff --git a/windows/device-security/auditing/images/event-6145.png b/windows/security/threat-protection/auditing/images/event-6145.png
similarity index 100%
rename from windows/device-security/auditing/images/event-6145.png
rename to windows/security/threat-protection/auditing/images/event-6145.png
diff --git a/windows/device-security/auditing/images/event-6416.png b/windows/security/threat-protection/auditing/images/event-6416.png
similarity index 100%
rename from windows/device-security/auditing/images/event-6416.png
rename to windows/security/threat-protection/auditing/images/event-6416.png
diff --git a/windows/device-security/auditing/images/event-6419.png b/windows/security/threat-protection/auditing/images/event-6419.png
similarity index 100%
rename from windows/device-security/auditing/images/event-6419.png
rename to windows/security/threat-protection/auditing/images/event-6419.png
diff --git a/windows/device-security/auditing/images/event-6420.png b/windows/security/threat-protection/auditing/images/event-6420.png
similarity index 100%
rename from windows/device-security/auditing/images/event-6420.png
rename to windows/security/threat-protection/auditing/images/event-6420.png
diff --git a/windows/device-security/auditing/images/event-6421.png b/windows/security/threat-protection/auditing/images/event-6421.png
similarity index 100%
rename from windows/device-security/auditing/images/event-6421.png
rename to windows/security/threat-protection/auditing/images/event-6421.png
diff --git a/windows/device-security/auditing/images/event-6422.png b/windows/security/threat-protection/auditing/images/event-6422.png
similarity index 100%
rename from windows/device-security/auditing/images/event-6422.png
rename to windows/security/threat-protection/auditing/images/event-6422.png
diff --git a/windows/device-security/auditing/images/event-6423.png b/windows/security/threat-protection/auditing/images/event-6423.png
similarity index 100%
rename from windows/device-security/auditing/images/event-6423.png
rename to windows/security/threat-protection/auditing/images/event-6423.png
diff --git a/windows/device-security/auditing/images/filters-xml-file.png b/windows/security/threat-protection/auditing/images/filters-xml-file.png
similarity index 100%
rename from windows/device-security/auditing/images/filters-xml-file.png
rename to windows/security/threat-protection/auditing/images/filters-xml-file.png
diff --git a/windows/device-security/auditing/images/firewall-settings-public-profile.png b/windows/security/threat-protection/auditing/images/firewall-settings-public-profile.png
similarity index 100%
rename from windows/device-security/auditing/images/firewall-settings-public-profile.png
rename to windows/security/threat-protection/auditing/images/firewall-settings-public-profile.png
diff --git a/windows/device-security/auditing/images/group-policy-editor.png b/windows/security/threat-protection/auditing/images/group-policy-editor.png
similarity index 100%
rename from windows/device-security/auditing/images/group-policy-editor.png
rename to windows/security/threat-protection/auditing/images/group-policy-editor.png
diff --git a/windows/device-security/auditing/images/group-policy.png b/windows/security/threat-protection/auditing/images/group-policy.png
similarity index 100%
rename from windows/device-security/auditing/images/group-policy.png
rename to windows/security/threat-protection/auditing/images/group-policy.png
diff --git a/windows/device-security/auditing/images/impact-property.png b/windows/security/threat-protection/auditing/images/impact-property.png
similarity index 100%
rename from windows/device-security/auditing/images/impact-property.png
rename to windows/security/threat-protection/auditing/images/impact-property.png
diff --git a/windows/device-security/auditing/images/ipconfig-command.png b/windows/security/threat-protection/auditing/images/ipconfig-command.png
similarity index 100%
rename from windows/device-security/auditing/images/ipconfig-command.png
rename to windows/security/threat-protection/auditing/images/ipconfig-command.png
diff --git a/windows/device-security/auditing/images/logging-settings-public-profile.png b/windows/security/threat-protection/auditing/images/logging-settings-public-profile.png
similarity index 100%
rename from windows/device-security/auditing/images/logging-settings-public-profile.png
rename to windows/security/threat-protection/auditing/images/logging-settings-public-profile.png
diff --git a/windows/device-security/auditing/images/msb.png b/windows/security/threat-protection/auditing/images/msb.png
similarity index 100%
rename from windows/device-security/auditing/images/msb.png
rename to windows/security/threat-protection/auditing/images/msb.png
diff --git a/windows/device-security/auditing/images/netsh-advfirewall-command.png b/windows/security/threat-protection/auditing/images/netsh-advfirewall-command.png
similarity index 100%
rename from windows/device-security/auditing/images/netsh-advfirewall-command.png
rename to windows/security/threat-protection/auditing/images/netsh-advfirewall-command.png
diff --git a/windows/device-security/auditing/images/netsh-command.png b/windows/security/threat-protection/auditing/images/netsh-command.png
similarity index 100%
rename from windows/device-security/auditing/images/netsh-command.png
rename to windows/security/threat-protection/auditing/images/netsh-command.png
diff --git a/windows/device-security/auditing/images/netsh-lan-command.png b/windows/security/threat-protection/auditing/images/netsh-lan-command.png
similarity index 100%
rename from windows/device-security/auditing/images/netsh-lan-command.png
rename to windows/security/threat-protection/auditing/images/netsh-lan-command.png
diff --git a/windows/device-security/auditing/images/offline-settings.png b/windows/security/threat-protection/auditing/images/offline-settings.png
similarity index 100%
rename from windows/device-security/auditing/images/offline-settings.png
rename to windows/security/threat-protection/auditing/images/offline-settings.png
diff --git a/windows/device-security/auditing/images/query-session.png b/windows/security/threat-protection/auditing/images/query-session.png
similarity index 100%
rename from windows/device-security/auditing/images/query-session.png
rename to windows/security/threat-protection/auditing/images/query-session.png
diff --git a/windows/device-security/auditing/images/registry-editor-audit.png b/windows/security/threat-protection/auditing/images/registry-editor-audit.png
similarity index 100%
rename from windows/device-security/auditing/images/registry-editor-audit.png
rename to windows/security/threat-protection/auditing/images/registry-editor-audit.png
diff --git a/windows/device-security/auditing/images/registry-editor-firewallrules.png b/windows/security/threat-protection/auditing/images/registry-editor-firewallrules.png
similarity index 100%
rename from windows/device-security/auditing/images/registry-editor-firewallrules.png
rename to windows/security/threat-protection/auditing/images/registry-editor-firewallrules.png
diff --git a/windows/device-security/auditing/images/schema-search.png b/windows/security/threat-protection/auditing/images/schema-search.png
similarity index 100%
rename from windows/device-security/auditing/images/schema-search.png
rename to windows/security/threat-protection/auditing/images/schema-search.png
diff --git a/windows/device-security/auditing/images/subkeys-under-security-key.png b/windows/security/threat-protection/auditing/images/subkeys-under-security-key.png
similarity index 100%
rename from windows/device-security/auditing/images/subkeys-under-security-key.png
rename to windows/security/threat-protection/auditing/images/subkeys-under-security-key.png
diff --git a/windows/device-security/auditing/images/subtree-deletion.png b/windows/security/threat-protection/auditing/images/subtree-deletion.png
similarity index 100%
rename from windows/device-security/auditing/images/subtree-deletion.png
rename to windows/security/threat-protection/auditing/images/subtree-deletion.png
diff --git a/windows/device-security/auditing/images/synaptics.png b/windows/security/threat-protection/auditing/images/synaptics.png
similarity index 100%
rename from windows/device-security/auditing/images/synaptics.png
rename to windows/security/threat-protection/auditing/images/synaptics.png
diff --git a/windows/device-security/auditing/images/synaptics1.png b/windows/security/threat-protection/auditing/images/synaptics1.png
similarity index 100%
rename from windows/device-security/auditing/images/synaptics1.png
rename to windows/security/threat-protection/auditing/images/synaptics1.png
diff --git a/windows/device-security/auditing/images/synaptics2.png b/windows/security/threat-protection/auditing/images/synaptics2.png
similarity index 100%
rename from windows/device-security/auditing/images/synaptics2.png
rename to windows/security/threat-protection/auditing/images/synaptics2.png
diff --git a/windows/device-security/auditing/images/synaptics3.png b/windows/security/threat-protection/auditing/images/synaptics3.png
similarity index 100%
rename from windows/device-security/auditing/images/synaptics3.png
rename to windows/security/threat-protection/auditing/images/synaptics3.png
diff --git a/windows/device-security/auditing/images/synaptics4.png b/windows/security/threat-protection/auditing/images/synaptics4.png
similarity index 100%
rename from windows/device-security/auditing/images/synaptics4.png
rename to windows/security/threat-protection/auditing/images/synaptics4.png
diff --git a/windows/device-security/auditing/images/synaptics5.png b/windows/security/threat-protection/auditing/images/synaptics5.png
similarity index 100%
rename from windows/device-security/auditing/images/synaptics5.png
rename to windows/security/threat-protection/auditing/images/synaptics5.png
diff --git a/windows/device-security/auditing/images/synaptics6.png b/windows/security/threat-protection/auditing/images/synaptics6.png
similarity index 100%
rename from windows/device-security/auditing/images/synaptics6.png
rename to windows/security/threat-protection/auditing/images/synaptics6.png
diff --git a/windows/device-security/auditing/images/synaptics7.png b/windows/security/threat-protection/auditing/images/synaptics7.png
similarity index 100%
rename from windows/device-security/auditing/images/synaptics7.png
rename to windows/security/threat-protection/auditing/images/synaptics7.png
diff --git a/windows/device-security/auditing/images/task-manager.png b/windows/security/threat-protection/auditing/images/task-manager.png
similarity index 100%
rename from windows/device-security/auditing/images/task-manager.png
rename to windows/security/threat-protection/auditing/images/task-manager.png
diff --git a/windows/device-security/auditing/images/wfpstate-xml.png b/windows/security/threat-protection/auditing/images/wfpstate-xml.png
similarity index 100%
rename from windows/device-security/auditing/images/wfpstate-xml.png
rename to windows/security/threat-protection/auditing/images/wfpstate-xml.png
diff --git a/windows/device-security/auditing/images/whoami-privilege-list.png b/windows/security/threat-protection/auditing/images/whoami-privilege-list.png
similarity index 100%
rename from windows/device-security/auditing/images/whoami-privilege-list.png
rename to windows/security/threat-protection/auditing/images/whoami-privilege-list.png
diff --git a/windows/device-security/auditing/images/windows-firewall-state-off.png b/windows/security/threat-protection/auditing/images/windows-firewall-state-off.png
similarity index 100%
rename from windows/device-security/auditing/images/windows-firewall-state-off.png
rename to windows/security/threat-protection/auditing/images/windows-firewall-state-off.png
diff --git a/windows/device-security/auditing/images/windows-firewall-with-advanced-security.png b/windows/security/threat-protection/auditing/images/windows-firewall-with-advanced-security.png
similarity index 100%
rename from windows/device-security/auditing/images/windows-firewall-with-advanced-security.png
rename to windows/security/threat-protection/auditing/images/windows-firewall-with-advanced-security.png
diff --git a/windows/device-security/auditing/images/windows-powershell-get-gpo.png b/windows/security/threat-protection/auditing/images/windows-powershell-get-gpo.png
similarity index 100%
rename from windows/device-security/auditing/images/windows-powershell-get-gpo.png
rename to windows/security/threat-protection/auditing/images/windows-powershell-get-gpo.png
diff --git a/windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions.md b/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md
similarity index 100%
rename from windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions.md
rename to windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md
diff --git a/windows/device-security/auditing/monitor-claim-types.md b/windows/security/threat-protection/auditing/monitor-claim-types.md
similarity index 100%
rename from windows/device-security/auditing/monitor-claim-types.md
rename to windows/security/threat-protection/auditing/monitor-claim-types.md
diff --git a/windows/device-security/auditing/monitor-resource-attribute-definitions.md b/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md
similarity index 100%
rename from windows/device-security/auditing/monitor-resource-attribute-definitions.md
rename to windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md
diff --git a/windows/device-security/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md
similarity index 100%
rename from windows/device-security/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md
rename to windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md
diff --git a/windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md
similarity index 100%
rename from windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md
rename to windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md
diff --git a/windows/device-security/auditing/monitor-the-resource-attributes-on-files-and-folders.md b/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md
similarity index 100%
rename from windows/device-security/auditing/monitor-the-resource-attributes-on-files-and-folders.md
rename to windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md
diff --git a/windows/device-security/auditing/monitor-the-use-of-removable-storage-devices.md b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md
similarity index 100%
rename from windows/device-security/auditing/monitor-the-use-of-removable-storage-devices.md
rename to windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md
diff --git a/windows/device-security/auditing/monitor-user-and-device-claims-during-sign-in.md b/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md
similarity index 100%
rename from windows/device-security/auditing/monitor-user-and-device-claims-during-sign-in.md
rename to windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md
diff --git a/windows/device-security/auditing/other-events.md b/windows/security/threat-protection/auditing/other-events.md
similarity index 100%
rename from windows/device-security/auditing/other-events.md
rename to windows/security/threat-protection/auditing/other-events.md
diff --git a/windows/device-security/auditing/planning-and-deploying-advanced-security-audit-policies.md b/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md
similarity index 100%
rename from windows/device-security/auditing/planning-and-deploying-advanced-security-audit-policies.md
rename to windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md
diff --git a/windows/device-security/auditing/registry-global-object-access-auditing.md b/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md
similarity index 100%
rename from windows/device-security/auditing/registry-global-object-access-auditing.md
rename to windows/security/threat-protection/auditing/registry-global-object-access-auditing.md
diff --git a/windows/device-security/auditing/security-auditing-overview.md b/windows/security/threat-protection/auditing/security-auditing-overview.md
similarity index 100%
rename from windows/device-security/auditing/security-auditing-overview.md
rename to windows/security/threat-protection/auditing/security-auditing-overview.md
diff --git a/windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md b/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md
similarity index 100%
rename from windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md
rename to windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md
diff --git a/windows/device-security/auditing/view-the-security-event-log.md b/windows/security/threat-protection/auditing/view-the-security-event-log.md
similarity index 100%
rename from windows/device-security/auditing/view-the-security-event-log.md
rename to windows/security/threat-protection/auditing/view-the-security-event-log.md
diff --git a/windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md b/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md
similarity index 100%
rename from windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md
rename to windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md