| ID | Event Description |
|---|---|
| 5140 | A network share object was accessed Audit Success, Audit Failure |
| 5142 | A network share object was added Audit Success |
| 5143 | A network share object was modified Audit Success |
| 5144 | A network share object was deleted Audit Success |
| 5168 | Spn check for SMB/SMB2 fails. Audit Failure |