Event ID 5145 records a check of whether a client can be granted access to a network share object. It is written for file or folder share access in the Security log and requires the Audit Detailed File Share subcategory. Review Share Name, Relative Target Name, Source Address and Accesses for suspicious share activity.
What Event ID 5145 Captures in Windows Auditing
Event ID 5145 is a detailed share-access audit event, so it tells you that Windows evaluated whether a client should be allowed to use a network share object. It is the share-level counterpart to file-system auditing, and it becomes useful when you need to see access attempts before or alongside file-level activity.
The most important fields are the share name, the relative target name, the source address, and the requested accesses. Together, those values show which share was queried, what part of the share was targeted, where the request came from, and what permission set was being checked.
Why 5145 Matters for Share Visibility
Event ID 5145 is valuable because many suspicious behaviours begin at the share layer rather than the file layer. A client may probe a share, enumerate resources, or repeatedly request access to paths it should not know about. When you review 5145 events together with file creation or read events, you can separate ordinary user activity from unusual access patterns.
It is also one of the few Windows audit events that can help you understand remote share access in context. That makes it especially useful for spotting lateral movement attempts, staging activity, or access from unexpected hosts. For broader Windows audit coverage and related event IDs, see the Windows Event Log Guide.
How to Read 5145 Alongside Other Evidence
A single 5145 record rarely tells the whole story. The source address helps you decide whether the request came from a known workstation, a server, or something unexpected, while the accessed share path can show whether the request was broad, targeted, or iterative. If the same source generates repeated share checks across multiple objects, that pattern is often more meaningful than one isolated event.
Security teams usually get the most value from 5145 when they compare it with logon activity, process activity, and nearby file access events. If a share check is followed by unusual file reads, writes, or administrative actions, that sequence can point to reconnaissance or access expansion rather than normal business use. Detection pipelines also benefit from correlation with endpoint telemetry such as the Sysmon Guide.
What Good Use Looks Like
Event ID 5145 is most useful when auditing is scoped to the shares that matter and the alert logic focuses on unusual source hosts, unexpected access masks, or rare target paths. It is not a high-value event by itself if the environment is too noisy or the share naming is inconsistent, because analysts then lose the ability to tell routine access from suspicious access.
Practitioners should treat 5145 as part of a broader monitoring strategy, not as a standalone detector. When a 5145 event looks risky, the next question is usually whether the request was permitted, whether the user or host should have been there, and whether other events show follow-on activity that confirms or dismisses abuse.
Risk and Threat Considerations
Event ID 5145 can expose early signs of reconnaissance, share enumeration, or unauthorized access attempts against network shares. It is especially relevant where shared folders contain scripts, data sets, backups, or administrative material that can support lateral movement or staging after the first foothold.
Failure mechanism: If share auditing is disabled, too narrow, or ignored in monitoring, repeated probing and unusual remote access can blend into normal file activity and the attacker can keep testing access without immediate detection.
Impact: Missed 5145 activity can delay discovery of suspicious share access, making it harder to contain data exposure, privilege abuse, or follow-on movement across systems that trust the same file shares.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | 5145 depends on detailed share-access audit generation. |
| AU-6 — Audit Record Review, Analysis, and Reporting | 5145 is most useful when analysts review and correlate share-access events. | |
| AC-3 — Access Enforcement | 5145 records whether access to a share object is granted or denied by policy. | |
| Recommendation — Enable detailed share auditing for network shares and monitor the resulting records. Review 5145 events with adjacent activity to identify suspicious share access patterns. Enforce share permissions so only authorized clients can access sensitive network shares. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Share-access auditing and review are core log-management concerns. |
| Recommendation — Collect, protect, and review share-access logs for suspicious or unauthorized activity. | ||
| MITRE ATT&CK | T1021 — Remote Services | Share access is often part of remote-service abuse and lateral movement paths. |
| Recommendation — Correlate share-access events with lateral movement indicators to detect remote service abuse. | ||
Practitioner Guidance
What to watch for: Focus on source addresses that do not match the expected user base, requests against administrative or rarely used shares, and repeated access checks that do not fit the normal business pattern. Those are often stronger indicators than a single denied or allowed check.
Governance implication: Treat 5145 as a monitored control signal, not just an audit artifact. The event is only useful when the organisation has an owner for share auditing, a review path for suspicious source hosts, and a clear threshold for escalation when access checks cluster around sensitive paths.