// REFERENCE
5143 — A network share was modified
Log: Security
Low risk
A share's properties changed (permissions, path). Loosening an existing share's permissions can open access to sensitive data; correlate with who modified it.
Related tools
Work with this in:
Related
5140
5140 — A network share was accessed 5145
5145 — Network share access was checked 5142
5142 — A network share was added 4648
4648 — Logon using explicit credentials
5140 — A network share was accessed 5145
5145 — Network share access was checked 5142
5142 — A network share was added 4648
4648 — Logon using explicit credentials
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.