01Fields in the event
- SubjectUserSid
- SubjectUserName
- SubjectDomainName
- SubjectLogonId
- ObjectType
- IpAddress
- IpPort
- ShareName
- ShareLocalPath
- RelativeTargetName
- AccessMask
- AccessList
- AccessReason
02Reading coded values
| Value | Meaning |
|---|---|
| 0x1 (%%4416) | ReadData (or ListDirectory): for a file, the right to read the file data; for a directory, the right to read or list the directory data. |
| 0x2 (%%4417) | WriteData (or AddFile): for a file, the right to write data to the file; for a directory, the right to create a file in the directory. |
| 0x4 (%%4418) | AppendData (or AddSubdirectory or CreatePipeInstance): for a file, the right to append data to the file; for a directory, the right to create a subdirectory; for a named pipe, the right to create a pipe. |
| 0x8 (%%4419) | ReadEA: the right to read extended file attributes. |
| 0x10 (%%4420) | WriteEA: the right to write extended file attributes. |
| 0x20 (%%4421) | Execute/Traverse: for a native code file, the right to execute it; for a directory, the right to traverse it. |
| 0x40 (%%4422) | DeleteChild: for a directory, the right to delete a directory and all the files it contains, including read-only files. |
| 0x80 (%%4423) | ReadAttributes: the right to read file attributes. |
| 0x100 (%%4424) | WriteAttributes: the right to write file attributes. |
| 0x10000 (%%1537) | DELETE: the right to delete the object. |
| 0x20000 (%%1538) | READ_CONTROL: the right to read the information in the object's security descriptor, not including the information in the system access control list (SACL). |
| 0x40000 (%%1539) | WRITE_DAC: the right to modify the discretionary access control list (DACL) in the object's security descriptor. |
| 0x80000 (%%1540) | WRITE_OWNER: the right to change the owner in the object's security descriptor. |
| 0x100000 (%%1541) | SYNCHRONIZE: the right to use the object for synchronization, which lets a thread wait until the object is in the signaled state. Some object types do not support it. |
| 0x1000000 (%%1542) | ACCESS_SYS_SEC: the right to get or set the SACL in the object's security descriptor. |
03How to use it
ShareName and RelativeTargetName give the file or folder that was reached; RelativeTargetName is a single backslash when access was requested for the share itself. AccessMask is the sum of the requested access rights and AccessList names them (the table below gives each right's hexadecimal value and its %% schema value, which is how AccessList carries it). The page describes the access check result as each requested right followed by Granted by or Denied by and the access control entry, in SDDL, that allowed or denied it. Join SubjectLogonId to the 4624 on the same computer and compare IpAddress. Microsoft's monitoring advice names these requested rights, especially in failures: WriteData, AppendData, WriteEA, DeleteChild, WriteAttributes, DELETE, WRITE_DAC and WRITE_OWNER.
04Ordinary causes
Any file or folder access through a share produces it: the page says the event is generated every time a file or folder on a network share is accessed, so ordinary file-share use leaves a stream of these records.
05Read it with
- 5140 A network share object was accessed5140 is the session-level record, written once per session at the first access attempt; 5145 is the file-level record. Both carry SubjectLogonId, IpAddress, IpPort and ShareName. Matching on these fields is a working method; the Microsoft pages do not describe it.
- 4624 An account was successfully logged onMicrosoft gives the Logon ID as a value that can be matched with the logon event, to see how the account that accessed the share logged on. Matching it places each file or folder access inside the logon session that made it.
06Caveats
Requires Audit Detailed File Share. Because it is written for each file or folder access, the volume can be high. Failure events are generated only when access is denied at the file share level; if access is denied at the file system (NTFS) level, no event is generated, so the absence of a failure record does not show that no attempt was refused.