Event ID 5143

A network share object was modified

A network share object was modified.

Subject:
    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:           %4

Share Information:
    Object Type:        %5
    Share Name:         %6
    Share Path:         %7
    Old Remark:         %8
    New Remark:         %9
    Old MaxUsers:       %10
    New Maxusers:       %11
    Old ShareFlags:     %12
    New ShareFlags:     %13
    Old SD:             %14
    New SD:             %15


Auditing:     Conditional


Volume:     Low


Microsoft Documentation

Event ID - 5143



NameFieldInsertion StringOSExample
Security IDSubjectUserSid%1Any DOMAINABC\jack.jackson
Account NameSubjectUserName%2Any jack.jackson
Account DomainSubjectDomainName%3Any DOMAINABC
Logon IDSubjectLogonId%4Any 0x38D15
Object TypeObjectType%5Any Directory
Share NameShareName%6Any \\*\SecretDocuments
Share PathShareLocalPath%7Any C:\Documents\Secret
Old RemarkOldRemark%8Any N/A
New RemarkNewRemark%9Any N/A
Old MaxUsersOldMaxUsers%10Any 0xffffffff
New MaxUsersNewMaxUsers%11Any 0xA
Old ShareFlagsOldShareFlags%12Any 0x800
New ShareFlagsNewShareFlags%13Any 0x800
Old SDOldSD%14Any O:S-1-5-21-3457937927-2839227994-823803824-1104G:DAD:(A;OICI;FA;;;BA)(A;OICI;FA;;;WD)
New SDNewSD%15Any O:BAG:DAD:(D;;FA;;;S-1-5-21-3457937927-2839227994-823803824-1104)(A;OICI;FA;;;WD)(A;OICI;FA;;;BA)


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"File Share"



LEFT/RIGHT arrow keys for navigation

Back to List