Event ID 5145 — Detailed control of, access to a sharing

Windows checked if a client could access a file or folder via network sharing.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• Normal SMB access
• Play or change files
• Attempts to deny access

Verifications to be carried out

1. Read This Target Name
2. Read Accesses
3. Identify Source Address and Account

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5145} -MaxEvents 50

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.