Windows-itpro-docs: Please include more details about the Event Log

[itguysocal]

For example, which Event "Source" or log should we expect to find these audited entries in.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 7d74aa43-09f5-0079-2d7a-342fda884c82
• Version Independent ID: 87a77027-3fc8-42a4-f070-b2bead59d570
• Content: Test how Windows Defender ATP features work
• Content Source: windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md
• Product: w10
• GitHub Login: @andreabichsel
• Microsoft Alias: v-anbic

[e0i]

@officedocsbot assign @e0i

[lindspea]

@itguysocal Thank you for reaching out. You can find this in the Windows Event Log. "While the features will not block or prevent apps, scripts, or files from being modified, the Windows Event Log will record events as if the features were fully enabled. This means you can enable audit mode and then review the event log to see what impact the feature would have had were it enabled."

[itguysocal]

Right, but my question is "which" Windows Event Log? System? Security? Application? I couldn't find it. So if the documentation can please be updated to list which event log "source" (that's a type of event log)

[e0i]

@andreabichsel

As requested by the issue author, Lindsay needs more information regarding different types of Windows Event Log for her editing.

Could you kindly point us to a right direction?

Thanks.

[andreabichsel]

I believe Applications and Services > Microsoft > Windows > Windows Defender > Operational.

@justinha Can you confirm with the product team?

@e0i I'm in another group now, and Justin's the right contact for these topics now. Thanks! :)

[Justinha]

Andrea's right. For more info, see https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard

[e0i]

@itguysocal

With the help of your feedback, the issue has been reviewed and an update to the documentation has been published.

Thank you for your feedback.

[e0i]

@officedocsbot close