Event ID: 5140

A network share object was accessed

A network share object was accessed.

    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:           %4

Network Information:    
    Source Address:     %5
    Source Port:        %6

Share Name:             %7

Logged the first time a network share is accessed during a logon session.

Microsoft Documentation

Event ID - 5140

Name Field Insertion String OS Example
Security ID SubjectUserSid %1 Any DOMAIN\theuser
Account Name SubjectUserName %2 Any theuser
Account Domain SubjectDomainName %3 Any DOMAIN
Logon ID SubjectLogonId %4 Any 0x541f98
Object Type ObjectType %5 Any File
Source Address IpAddress %6 Any
Source Port IpPort %7 Any 40215
Share Name ShareName %8 Any \\*\Documents
Share Path ShareLocalPath %9 Any \??\C:\Documents
Access Mask AccessMask %10 Any 0x1
Access List AccessList %11 Any View Codes

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"File Share"

LEFT/RIGHT arrow keys for navigation

Back to List