Event ID 5140

A network share object was accessed

A network share object was accessed.

Subject:
    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:           %4

Network Information:
    Object Type:        %5
    Source Address:     %6
    Source Port:        %7

Share Name:             %8
Share Path:             %9

Access Request Information:
    Access Mask:        %10
    Accesses:           %11


Auditing:     Conditional


Volume:     LowMedium


Logged the first time a network share is accessed during a logon session.


Microsoft Documentation

Event ID - 5140



NameFieldInsertion StringOSExample
Security IDSubjectUserSid%1Any DOMAIN\theuser
Account NameSubjectUserName%2Any theuser
Account DomainSubjectDomainName%3Any DOMAIN
Logon IDSubjectLogonId%4Any 0x541f98
Object TypeObjectType%5Any File
Source AddressIpAddress%6Any 10.23.44.12
Source PortIpPort%7Any 40215
Share NameShareName%8Any \\*\Documents
Share PathShareLocalPath%9Any \??\C:\Documents
Access MaskAccessMask%10Any 0x1
Access ListAccessList%11Any View Codes


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"File Share"



LEFT/RIGHT arrow keys for navigation

Back to List