Event ID 5140 is a Windows Security audit event for access to a network share object. It is written once per session at the first access attempt. Use the share name, source address and account name to spot unauthorised file access, lateral movement or excessive share discovery.
What Event ID 5140 Means in Windows Logging
Event ID 5140 is the Windows Security audit record for access to a network share object. It is generated on first access within a session, so it is best read as a session marker rather than a complete file-by-file activity trail.
For defenders, the value is in the metadata around the event: share name, source address and account name. Those fields help you determine who touched a share, from where, and whether the access pattern fits expected administration or user behaviour.
Because it is share-level telemetry, Event ID 5140 is often used to identify reconnaissance, unauthorized file access and internal movement between systems. It can also reveal whether a single account is browsing many shares in a way that suggests discovery or staging activity.
What You Can Infer From a 5140 Record
A single 5140 event does not prove malicious activity by itself. It shows that a network share was accessed, but it does not tell you what files were read, copied, changed or encrypted. That means it should be interpreted alongside other Windows audit events and endpoint or network telemetry.
The most useful analytical questions are whether the account normally uses that share, whether the source host is expected, and whether the access aligns with the time and role of the user or service. Unusual combinations, such as a workstation account accessing administrative shares, are often more informative than the event alone.
When available, pair share access with logon, object access and process data to separate routine business use from suspicious lateral movement. Windows Event Log Guide is a useful reference point for placing 5140 alongside related Windows event IDs and audit policy decisions.
How to Use 5140 for Detection and Investigation
Event ID 5140 becomes most useful when it is treated as a correlation point. Repeated access from a new source, access by a privileged account outside its normal pattern, or broad share discovery across a short period can indicate a security issue that deserves investigation.
In practice, the event helps answer which host initiated the access, which account was used and which share was touched. That is enough to triage suspicious activity, establish scope and decide whether the access was part of legitimate administration, data collection or a possible attacker foothold.
If you already ingest richer endpoint telemetry, share events should reinforce, not replace, that data. For example, process creation, remote logon and network connection records can show how the share was reached, while 5140 shows the shared resource that was targeted. Sysmon Guide is a natural companion when you want to enrich share-access analysis with host-level context.
Why Event ID 5140 Matters Operationally
Share access logging is only valuable if the audit policy is enabled, the logs are retained long enough, and the data is searchable at scale. In many environments, 5140 is most useful when it is forwarded centrally and paired with baselines for normal file-server behaviour.
Teams should also remember that noisy or incomplete logging reduces the event’s value. If only one access attempt per session is recorded, you may need other events to understand the full sequence of activity. That is why 5140 is best treated as one signal in a broader Windows detection strategy.
For threat hunting, the event supports questions about lateral movement, shared-folder discovery and unauthorized internal access. It is especially useful when the same account appears across multiple servers or when the source address does not fit the expected user population. Kerberos Security Guide can help when suspicious share access is part of a wider credentialed access pattern.
Risk and Threat Considerations
Event ID 5140 matters because share access is a common foothold for internal reconnaissance and data theft. A compromised account, an overbroad share, or a mis-scoped administrative mapping can expose sensitive files and reveal where valuable data lives.
Failure mechanism: An attacker or insider uses legitimate network share access to browse, stage or copy data, often before stronger alerts trigger. Because the event is session-based and share-level, it may show the first access but not the full extent of file activity.
Impact: Organisational exposure can include unauthorized disclosure, lateral movement, and faster spread inside the environment if shared folders contain credentials, scripts, backups or sensitive operational data.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1021.002 — Remote Services: SMB/Windows Admin Shares | 5140 often appears during share-based lateral movement and remote file access. |
| Recommendation — Correlate 5140 with SMB lateral-movement activity and investigate hosts accessing administrative shares unexpectedly. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | 5140 is an audit record whose value depends on generating and collecting share-access logs. |
| AU-6 — Audit Review, Analysis, and Reporting | 5140 supports investigations only when reviewed in context with account, host and share patterns. | |
| AC-6 — Least Privilege | Share access events are more actionable when access rights are narrowly scoped to job needs. | |
| Recommendation — Configure audit generation and central collection so share-access events are reliably retained and searchable. Review share-access logs for anomalous source accounts, hosts and access patterns. Limit share permissions so excessive access is not available for abuse. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | 5140 is a Windows audit signal that should be centrally collected and protected from loss. |
| CIS-6 — Access Control Management | The event often exposes overbroad or unexpected share access, which is an access-control issue. | |
| Recommendation — Centralize and protect Windows share-access logs for detection and investigation. Review and tighten share permissions to reduce unauthorized access paths. | ||
Practitioner Guidance
What to watch for: Focus on source addresses, account names and share names that do not match normal administration patterns. A sudden rise in new share access from one host, or privileged access from an unusual workstation, deserves review even if the event itself is not overtly malicious.
Governance implication: Treat 5140 as a baseline signal for share hygiene, not just a log entry. Clear ownership of file shares, access reviews for sensitive locations and consistent log forwarding make the event materially more useful for detection and incident response.