Event-o-Pedia EventID 5140 - A network share object was accessed. [2008]

	Event Details
	User Activity->Object Access->File System Object Access->Windows 2008->EventID 5140 - A network share object was accessed. [2008]

EventID 5140 - A network share object was accessed. [2008]

Linked Event:

EventID 5140 - A network share object was accessed. [2008]

Sample:

A network share object was accessed.
	
Subject:
	Security ID:		S-1-5-18
	Account Name:		DCC1$
	Account Domain:		LOGISTICS
	Logon ID:		0x418494
Network Information:	
	Source Address:		fe80::c1bc:6e78:ac4e:3ee
	Source Port:		51736
	
Share Name:			\\*\IPC$
===========================
Description template stored in adtschema.dll:
===========================
A network share object was accessed.
	
Subject:
	Security ID:		%1
	Account Name:		%2
	Account Domain:		%3
	Logon ID:		%4

Network Information:	
	Source Address:		%5
	Source Port:		%6
	
Share Name:			%7

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

Security

Filtering Field	Equals to Value
OSVersion	Windows Vista (2008)
Category	Object Access
Source	Microsoft-Windows-Security-Auditing
TaskCategory	File Share
EventId	5140

Field Matching

Field	Description	Stored in	Sample Value
When	At what date and time a user activity originated in the system.	DateTime	10.10.2000 19:00:00
Who	Account or user name under which the activity occured.	Subject: Account Name	DCC1$
What	The type of activity occurred (e.g. Logon, Password Changed, etc.)	"Network share accessed"	Network share accessed
Where	The name of the workstation/server where the activity was logged.	Computer	DC1
Where From	The name of the workstation/server where the activity was initiated from.	Network Information: Source Address	fe80::c1bc:6e78:ac4e:3ee
Severity	Specify the seriousness of the event.	-	High
WhoDomain		Subject: Account Domain	LOGISTICS
WhereDomain		-
Result	Successful or Failed	-
Object Name		Object Name
Object Type		"File Share"	File Share
Whom		InsertionString7
Security ID		Subject: Security ID	S-1-5-18
Account Name		InsertionString2	DCC1$
Account Domain		InsertionString3	LOGISTICS
Source Address		InsertionString5	fe80::c1bc:6e78:ac4e:3ee
Source Port		Network Information: Source Port	51736
Share Name		InsertionString7