IT Toolbox
Menu
HomeEvent ID 5140 — Access to network sharing
Guide

Event ID 5140 — Access to network sharing

A network sharing was accessed

TopicIT resources → About 1 min read

A network sharing was accessed.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

  • Normal access to SMB sharing
  • Script or network application
  • Recognition of sharing

Verifications to be carried out

  1. Read Share Name
  2. Identify Source Address
  3. Correlate with Account and Detailed Access 5145

Commands

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5140} -MaxEvents 50

Key takeaways

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.

Support the development of BAOI Hosting, domains and new IT resources.
❤️ Support BAOI

My favorites