Event ID 5145Audit SuccessSecurity
Windows Event ID 5145 — Network Share Object Access Checked
Logged when access is checked on a file or folder within a network share — more granular than 5140 (share level) but very high volume.
Why It Matters
Provides file-level visibility into what an account accessed within a share. Useful for data theft investigations but generates extreme log volume — typically only enable for specific sensitive shares.
Key Fields
Share NameThe parent share
Relative Target NameThe specific file or folder accessed within the share
Account NameWho accessed it
Investigation Tips
- 1.Only enable on shares containing sensitive data — enabling everywhere generates millions of events per day.
- 2.Use for post-incident forensics to reconstruct exactly which files an attacker accessed.
Go deeper: the full Lateral Movement — Spreading Across the Network guide
Explore the related technique, investigation steps, and evidence to consider alongside this event.
Read the Lateral Movement — Spreading Across the Network guide →See Event ID 5145 in your logs
Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.
Decode an event →