Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsEvent ID 5145 records a Windows network-share access check: a client requested access to a file or folder through an SMB share, and Windows evaluated whether the request was allowed at the share level. It is logged in the Security log on the computer hosting the share.
That distinction matters. Event 5145 can show the account, source address, share, target, requested rights, and share-level result, but it does not by itself prove that someone successfully read, copied, changed, or deleted a file.
As an Amazon Associate I earn from qualifying purchases.
What Event ID 5145 means
Event 5145 is generated by the Microsoft-Windows-Security-Auditing provider in the Security channel. Its task is Detailed File Share, its event version is 0, and Microsoft documents it for Windows Vista and Windows Server 2008 and later systems.
Recommended Free Tools
In plain language, Windows received a request through a network share and checked whether the client could receive the requested access. The event is therefore best understood as an authorization-decision record for a share request, not as a complete file-usage audit trail.
#1 Best Overall
- Your Personal Streaming Server - Build your own Netflix-style media library and stream 4K movies, shows and photos to any device without monthly fees
- Create Your Own Cloud - Store your entire photo, video and music collection; access from anywhere with fast 282 MB/s transfer speeds
- Creator-Grade Backup Solution - Protect your irreplaceable content with automated backups to cloud services, external drives and remote NAS
- Multi-Layered Data Protection - Combine RAID redundancy, automated backups and snapshot technology to prevent data loss from any cause
- Smart Home Surveillance - Support up to 30 IP cameras with AI detection, instant alerts and secure remote monitoring
The check described by 5145 is separate from NTFS authorization. A request can pass the share-permission check and still be denied by the file system. Conversely, Microsoft states that a denial at the NTFS layer does not generate a corresponding Event 5145 failure; 5145 failures represent denials at the file-share level. See the Microsoft Event 5145 reference.
Event 5145 versus related audit events
| Audit policy | What it records | Typical event |
|---|---|---|
| Audit File Share | A connection or access to a shared folder | 5140 |
| Audit Detailed File Share | Detailed checks for files and folders accessed through a share | 5145 |
| Audit File System | Access to local file-system objects with matching SACLs | Other object-access events, depending on the operation |
Microsoft describes Audit File Share as recording an event when a connection is established between a client and a share. Audit Detailed File Share records detailed access checks for files and folders accessed through a share. The difference is documented in Microsoft’s Audit policy documentation and its Audit File Share guidance.
Detailed File Share auditing does not require a SACL on every shared folder. File-system auditing does require a matching SACL. Enabling Detailed File Share can consequently audit access checks across all shared files and folders on that computer, which is a major reason for its potentially high volume.
How to enable Audit Detailed File Share
Group Policy
- Open Group Policy Management, or open the local security policy editor for a standalone computer.
- Edit the computer policy that applies to the share-hosting server.
- Go to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → System Audit Policies → Object Access.
- Open Audit Detailed File Share.
- Select Success, Failure, or both, then apply the policy.
- Run
gpupdate /forceif you need to request immediate policy refresh.
The policy settings correspond to:
0— Off1— Success2— Failure3— Success and Failure
Microsoft’s policy mapping is available in the Audit Policy CSP documentation.
Rank #2
- Secure private cloud - Enjoy 100% data ownership and multi-platform access from anywhere
- Easy sharing and syncing - Safely access and share files and media from anywhere, and keep clients, colleagues and collaborators on the same page
- Automated Backup Protection - Set-and-forget backups for Macs, PCs and mobile devices to multiple destinations including cloud and external drives
- Home Security System - Record and monitor your property 24/7 with support for multiple IP cameras and remote viewing
- 2-Year Warranty - Reliable hardware backed by Synology's expert customer support team and ongoing software updates
Using auditpol
Query the current setting:
auditpol /get /subcategory:"Detailed File Share"Enable both successful and failed share-level checks:
auditpol /set /subcategory:"Detailed File Share" /success:enable /failure:enableEnable failures only:
auditpol /set /subcategory:"Detailed File Share" /success:disable /failure:enableDisable the subcategory:
auditpol /set /subcategory:"Detailed File Share" /success:disable /failure:disableThese commands are described in Microsoft’s auditpol reference. A domain-based Group Policy can overwrite a local auditpol setting, so query the effective policy after making a change and identify the authoritative GPO.
How to find Event 5145
Event Viewer
- Open Event Viewer.
- Open Windows Logs → Security.
- Select Filter Current Log.
- Enter
5145in Event IDs.
Inspect the Security log on the server hosting the share, not automatically on the client that initiated the request. For large logs, PowerShell or your event collector is usually more practical than loading the entire log in the graphical console.
Free tools Windows power users keep installed
One-click scans. No signup required.
PowerShell
Get-WinEvent -FilterHashtable @{
LogName = 'Security'
Id = 5145
} |
Select-Object TimeCreated, Id, ProviderName, MessageTo search rendered messages for a share or target:
Get-WinEvent -FilterHashtable @{
LogName = 'Security'
Id = 5145
} |
Where-Object {
$_.Message -match 'Share Name:s+\\*\Finance' -or
$_.Message -match 'Relative Target Name:s+.*payroll'
} |
Select-Object TimeCreated, MessageMessage text can vary by locale and event-rendering behavior. For SIEM ingestion and automation, parse the structured XML fields rather than localized display text. Preserve the original XML when an event may become evidence.
Rank #3
- One Place for All Your Data - Consolidate scattered files from multiple computers, phones and external drives into one accessible hub with 100% ownership
- Professional File Collaboration - Share projects with clients, sync documents across teams and maintain version control without Dropbox fees
- Automated Backup Protection - Set-and-forget backups for Macs, PCs and mobile devices to multiple destinations including cloud and external drives
- DIY Surveillance System - Transform IP cameras into a professional monitoring solution with motion alerts, recording schedules and remote viewing
- 2-Year Warranty - Reliable hardware backed by Synology's expert customer support team and ongoing software updates
Important Event 5145 fields
| Field | What it tells you |
|---|---|
SubjectUserSid |
The SID of the account making the request. |
SubjectUserName |
The account name used in the request. |
SubjectDomainName |
The domain or computer context associated with the account. |
SubjectLogonId |
A logon-session identifier that can help correlate the request with events such as 4624. |
ObjectType |
Usually File. |
IpAddress |
The client address. IPv4-mapped IPv6 and loopback values are possible. |
IpPort |
The source port. Local requests may show 0. |
ShareName |
The network share, commonly shown in a form such as \*Finance. |
ShareLocalPath |
The server-side path behind the share. It may be empty for special shares such as IPC$. |
RelativeTargetName |
The file or directory below the share. A request for the share itself may show |
AccessMask |
A hexadecimal combination of requested rights. |
Accesses |
A human-readable description of the requested rights. |
AccessCheckResults |
Information about which requested rights were granted or denied and the ACE involved. |
To reconstruct the target, combine the share’s server-side path with the relative target. ShareName alone is not necessarily a full file path. The AccessMask is hexadecimal and may contain several rights at once; use the decoded Accesses and access-check information rather than treating it as a single operation.
Administrative and interprocess shares, especially \*IPC$, can generate substantial background activity. Their presence is not automatically suspicious.
Does Event 5145 prove that someone opened or copied a file?
No. It proves that Windows performed a detailed share-level access check for a requested target and rights. A successful check may indicate that the request was allowed at the share layer, but it does not independently prove that:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- An application successfully read the file contents.
- The entire file was copied or exfiltrated.
- A write changed the file.
- A deletion completed.
- A person manually opened the file.
- The activity was interactive rather than generated by a service, backup agent, antivirus product, indexing service, mapped drive, or operating-system process.
Use terms such as access attempt, authorization check, and share-level access decision unless other evidence supports a stronger conclusion. For investigations, correlate 5145 with:
Rank #4
- Supports drives on the model's official compatibility list
- Up to 522/565 MB/s sequential read/write throughput supports stable data transfers.
- Dual 2.5GbE ports provide fast network transfer speeds and increased redundancy.
- Leverage built-in file and photo management, data protection, virtualization, and surveillance solutions.
- Backed by Synology's 3-year limited hardware warranty.
- Event 4624 and other authentication records, using the logon ID where applicable.
- NTFS file-system auditing and the relevant object-access events.
- SMB server logs and endpoint telemetry.
- Process, command-line, and network telemetry.
- File-integrity monitoring or DLP records.
Why a failed access may not produce Event 5145
Not every failed attempt to use a file through a share appears as a 5145 failure. Check these possibilities:
- NTFS denial: Microsoft documents 5145 failures for share-level denials; an NTFS-only denial does not generate the corresponding 5145 failure.
- Audit policy disabled: The policy may not have applied, or a domain GPO may have overwritten a local setting.
- Wrong computer: Look on the server hosting the share.
- Retention loss: The Security log may have overwritten the record, or forwarding may have filtered or dropped it.
- Different access path: Local access, another protocol, or another storage layer may not create an SMB share event.
Success, failure, or both?
Failure-only
Failure-only auditing is usually the best starting point on a busy system. It reduces volume while helping identify share-level denials, unauthorized requests, and configuration errors. Microsoft’s detailed-share guidance recommends monitoring failures because the volume should generally be manageable, particularly compared with unrestricted success auditing.
Success-only
Success events can help answer who successfully requested access to shared content, but file servers may generate records for routine reads. Domain controllers can be especially noisy because of SYSVOL activity. Broad success auditing can bury unusual behavior in normal background traffic.
Both
Use both for a narrowly scoped incident, a sensitive share, or a short evidence-collection window when Security-log sizing, forwarding, retention, and SIEM capacity have been planned. Do not enable both globally without measuring the resulting event rate.
Best Value
- Team Productivity & Media Hub - Share large files and stream media across your office with 278 MB/s speeds; support concurrent access from 10+ users
- Centralized Repository - Store company documents, client files and media assets with granular access controls and audit logs
- Multi-Layered Data Protection - Combine RAID redundancy, automated backups and snapshot technology to prevent data loss from any cause
- Professional Surveillance System - Monitor home or business with support for 30 IP cameras, motion detection and secure remote access
- 3-Year Warranty & Enterprise Support - Dedicated technical account management is available for business-critical production environments
Reducing noise and protecting retention
Microsoft classifies Detailed File Share volume as high on file servers and domain controllers, partly because domain controllers handle SYSVOL access. Volume is lower on many member servers and workstations, but the actual rate depends on workload, applications, authentication patterns, shares, and whether success auditing is enabled.
- Start with Failure auditing.
- Apply the policy to file servers or sensitive systems rather than indiscriminately everywhere.
- Classify noisy traffic from
IPC$, administrative shares, SYSVOL, backup systems, indexing, antivirus, and management tools. - Size the Security log for the expected workload.
- Forward events promptly to a central collector or SIEM.
- Filter downstream only after confirming the raw events are not needed for response.
- Monitor event rates after enabling the policy.
- Temporarily enable success auditing for a defined investigation window, then narrow or disable it.
Do not use a universal events-per-second estimate: a busy file server and a lightly used member server can differ dramatically.
Using Event 5145 in an investigation
- Start with the account SID and name, source address, share, relative target, requested rights, and timestamp.
- Group activity by account, source IP, share, and logon ID.
- Correlate
SubjectLogonIdwith authentication events where possible. - Determine whether the request was allowed or denied at the share layer.
- Check NTFS permissions and file-system auditing separately.
- Identify the client process or service responsible using endpoint or process telemetry.
- Compare the activity with approved backup, indexing, antivirus, software-deployment, and administrative behavior.
- Preserve raw structured events and establish whether the activity was isolated, repeated, or part of a larger sequence.
Useful detection hypotheses include repeated share-level denials, a privileged account accessing an unusual share, a new source IP touching a sensitive share, bulk requests across many targets, and write or delete-related rights outside expected hours. These are leads, not proof of malicious activity: legitimate automation can produce the same pattern.
Generic SIEM logic
Event ID = 5145
AND (
RelativeTargetName matches sensitive path
OR ShareName matches sensitive share
OR SubjectUserName is privileged
OR IpAddress is outside approved range
)A higher-confidence rule can add an unusual source, unusual time, repeated access, and suspicious account or process context. Avoid alerting on every 5145 event, especially successful events on busy servers.
When native tools are enough—and when to add a SIEM
Event Viewer, Group Policy, auditpol, PowerShell, and Windows Event Forwarding are sufficient for many short-term investigations and basic centralized collection. A SIEM becomes more useful when you need long-term retention, cross-host correlation, dashboards, alert workflows, or links to identity and endpoint telemetry.
Relevant options include:
- Microsoft Sentinel: A natural fit for organizations already using Azure, Entra ID, Defender, and Log Analytics. Microsoft describes usage-based pricing and commitment tiers; related Azure services may add charges. See Sentinel pricing.
- Splunk Enterprise Security or Splunk Platform: Suited to mature SOCs needing extensive search and correlation. Splunk presents workload, ingest, and entity-oriented models and directs buyers to request an estimate at its pricing page.
- Elastic Security: Offers hosted, serverless, and self-managed approaches for teams comfortable operating Elasticsearch-based tooling. See Elastic pricing and its Event 5145 detection documentation.
- Rapid7 InsightIDR: A managed-feeling SIEM and detection platform; Rapid7 documents collecting 5145 through file-access monitoring. See Rapid7’s guidance and package information.
Compare Windows collection reliability, structured XML parsing, filtering, retention, success-event ingestion costs, identity and endpoint correlation, deployment requirements, and available analyst support. A commercial platform is not required merely to understand or enable Event 5145.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
