Event ID 5140 and 5145: a network share was accessed

Event 5140 is written when someone opens a network share on this computer – the share, the account and the source address. 5145 goes further and logs every file checked in the share. Access to the hidden admin shares C$ and ADMIN$ is how remote admin tools (and many attackers and ransomware) copy programs onto a Server.

In short

5140: a share was opened (once per session and share). Audit subcategory File Share.
5145: every file access in the share was checked. Subcategory Detailed File Share – very noisy.
Key fields: Share Name, Source Address, Account Name; for 5145 also the file (Relative Target Name).
Worth a look: ADMIN$ or C$ from a computer that is not an admin workstation; many shares from one address; access at night.

1. Switch it on

auditpol /set /subcategory:"{0CCE9224-69AE-11D9-BED3-505054503030}" /success:enable /failure:enable

That is File Share (5140). Detailed File Share (5145, GUID {0CCE9244-69AE-11D9-BED3-505054503030}) logs every file and can write thousands of events per minute on a file Server – use it only for a limited time or only for Failure.

2. PowerShell: who opened which share

function Get-EventFields($e) { $d = [ordered]@{}; ([xml]$e.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }; [pscustomobject]$d }
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5140; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  ForEach-Object { $f = Get-EventFields $_
    [pscustomobject]@{ Time = $_.TimeCreated; Share = $f.ShareName; From = $f.IpAddress; User = "$($f.SubjectDomainName)\$($f.SubjectUserName)" } } |
  Group-Object Share, From, User | Sort-Object Count -Descending | Select-Object Count, Name

Only the admin shares:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5140; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  ForEach-Object { Get-EventFields $_ } | Where-Object { $_.ShareName -match '\\(ADMIN|[A-Z])\$$' } |
  Select-Object ShareName, IpAddress, SubjectUserName

3. Normal or attack?

Normal: users opening their departments' shares; SYSVOL and NETLOGON on domain controllers (every computer reads them); IPC$ (named pipes for many Windows functions); your backup and management tools on ADMIN$ / C$.
Suspicious: ADMIN$ followed by a new service (7045, e.g. PSEXESVC) from a computer that is not an admin workstation; one address opening shares on many Servers; a user account accessing C$; access from outside your network at all.

SMB (port 445) should never be reachable from the internet – check your firewall rules and router.

4. Let Coinetic watch it for you

Coinetic watches the network side of this computer for you:

Port scanners and password guessers are banned automatically by a Windows Firewall rule.
Open ports at a glance: every listening port, the program behind it and who can reach it through the firewall.
Outbound control: see which program wanted to go out, and allow or block it with one click.
Ask AI (Pro + AI): “Is this an attack or just background scanning?”

Protect this Server or PC in 5 minutes

Download Coinetic, install, done: it starts protecting at once. 30 days free with all features, no payment details. From $20 per computer per year.

Start the free 30-day trial →

More guides: all Coinetic guides.

Frequently asked

Why is 5140 logged only once?

5140 is written when a session first connects to a share. Further access in the same session does not create new 5140 entries - that is what 5145 is for.

What is IPC$?

A special share for named pipes that many Windows functions use (remote management, printing, RPC). Access to it alone is normal.

Can I see which file was deleted?

With 5145 (Detailed File Share) you see access checks per file, or with object access auditing on the folder (Event 4663). Both are noisy - enable them only where needed.