Event 5140 comes from the File Share subcategory and fires when a client first reaches a network share in a session. Microsoft's description says it fires once per session. A user who opens a share and browses it for an hour produces one 5140, where the Detailed File Share subcategory behind 5145 would write an event for every file and folder. That makes 5140 a cheap, durable record of which accounts connected from which addresses to which shares, so keep it for months.
The volume story differs from its sibling's. Microsoft rates the File Share subcategory high on file servers and on domain controllers, where Group Policy clients keep reading SYSVOL, but low on member servers and workstations. Its table recommends Success and Failure auditing across domain controllers, member servers and workstations. In practice you can enable it estate-wide and still keep the data volume manageable, which is the opposite of what you can say about 5145. Shares carry no system access control lists, so once the subcategory is on, access to every share on the machine is audited.
Read the fields in the order an investigation uses them. SubjectUserName and SubjectLogonId tell you who and tie the event to the 4624 network logon that created the session. IpAddress and IpPort are the client, and Microsoft documents the address as IPv6 or an IPv4-mapped ::ffff: form, which breaks naive joins against asset inventories. ShareName is written as \\*\SHARE and ShareLocalPath is the NTFS location behind it, such as \??\C:\ for the C$ share, and it is empty for IPC$. ObjectType is always File.
Two fields are constants, and treating them as variables wastes effort. AccessMask is always 0x1 and AccessList is always ReadData for this event, because the event records the connection and not the operation. Filtering on write rights here will return nothing. If you need to know whether the client wrote to the share, that is 5145.
Share names are where the detection lives. C$, ADMIN$ and IPC$ are the default administrative shares, and the trailing dollar sign hides them from browsing, not from the log. Microsoft's own monitoring advice for 5140 names C$ on domain controllers as an example of what to watch, alongside source addresses outside your internal ranges and computers that should never connect to this one. MITRE groups administrative share use under SMB/Windows Admin Shares (T1021.002) and enumeration of shares under Network Share Discovery (T1135).
The sample shows a regular user, a.chen, opening C$ from 198.51.100.64 with the only right this event can carry. Opening the root of a peer's C$ implies local administrator rights on that machine, and a standard user rarely needs it. The event alone cannot say whether it was a help-desk visit or a pass-the-hash hop, and that is fine. Its job is to put the edge on the map: this source touched that host, as this account, at this minute.
To switch it on, enable Audit File Share under Object Access in Advanced Audit Policy, or run auditpol /set /subcategory:"File Share" /success:enable /failure:enable on the host. Read the result back with auditpol /get /subcategory:"File Share" before assuming coverage. The failure half is not an afterthought: 5140 also has a failure form, and a burst of failures from one source across many hosts is either a scanner without rights or someone trying credentials against administrative shares.
Treat the output as a graph. Each event is an edge from a source address to a host through a named share. After a few weeks of data you know which edges are normal: the backup server reaching file servers, the scanner reaching everything, the jump host reaching servers. Anything else is a new edge, and in a flat network a new edge between two workstations is the cheapest lateral movement signal Windows will give you.
The limit to remember is the same property that makes the event cheap. Because it is logged per session, a client that keeps one SMB session open for hours generates one record. Activity inside that session never produces another 5140, so a quiet log is not proof that nothing happened. Follow any suspicious 5140 into 5145 on the same host for the files, and into the 4624 for the authentication details.
