01Fields in the event
- SubjectUserSid
- SubjectUserName
- SubjectDomainName
- SubjectLogonId
- ObjectType
- IpAddress
- IpPort
- ShareName
- ShareLocalPath
- AccessMask
- AccessList
02How to use it
Use SubjectLogonId to join the event to the 4624 on the same computer and IpAddress to see where the connection came from; ShareName and ShareLocalPath show which share was reached. Microsoft's monitoring advice is to watch all share access, or access to specific shares, on high-value computers, and to look at source addresses outside your internal range. The event is written once per session, so use 5145 to see which files and folders were touched. As a first pass, set aside the entries for the IPC share (its name ends in a dollar sign) and for NetLogon, then read the remaining shares; check on the system itself that this hides nothing the question depends on.
03Ordinary causes
Any ordinary use of a file share produces it: the page says the event is generated every time a network share object is accessed, once per session at the first access attempt. A single entry therefore says only that a client reached the share.
04Read it with
- 5145 A network share object was checked to see whether client can be granted desired access5145 records each file or folder access under the Audit Detailed File Share subcategory, while 5140 is written once per session. Both carry SubjectLogonId, IpAddress, IpPort and ShareName, so the file-level records can be placed under the session record. Matching on these fields is a working method; the Microsoft pages do not describe it.
- 4624 An account was successfully logged onMicrosoft gives the Logon ID as a value that can be matched with the logon event, to see how the account that accessed the share logged on. IpAddress appears in both events; comparing it is a working method, not something the page states.
05Caveats
Requires Audit File Share. Written once per session, at the first access attempt, so it does not list the files touched or what happened later in the session. For this event AccessMask is always 0x1 and the access list is always ReadData (or ListDirectory), so it cannot show writing or deleting. ObjectType is always File. ShareLocalPath can be empty, for example for the IPC share.
07Sources
- Microsoft Learn — 5140(S, F) A network share object was accessed checked 2026-10-23