Audit File Share

Audit File Share allows you to audit events related to file shares: creation, deletion, modification, and access attempts. Also, it shows failed SMB SPN checks.

There are no system access control lists (SACLs) for shares; therefore, after this setting is enabled, access to all shares on the system will be audited.

Combined with File System auditing, File Share auditing enables you to track what content was accessed, the source (IP address and port) of the request, and the user account that was used for the access.

Event volume:

• High on file servers.

• High on domain controllers because of SYSVOL network access required by Group Policy.

• Low on member servers and workstations.

Computer Type	General Success	General Failure	Stronger Success	Stronger Failure	Comments
Domain Controller	Yes	Yes	Yes	Yes	We recommend Success auditing for domain controllers, because it’s important to track deletion, creation, and modification events for network shares. We recommend Failure auditing to track failed SMB SPN checks and failed access attempts to network shares.
Member Server	Yes	Yes	Yes	Yes	We recommend Success auditing to track deletion, creation, modification, and access attempts to network share objects. We recommend Failure auditing to track failed SMB SPN checks and failed access attempts to network shares.
Workstation	Yes	Yes	Yes	Yes	We recommend Success auditing to track deletion, creation, modification and access attempts to network share objects. We recommend Failure auditing to track failed SMB SPN checks and failed access attempts to network shares.

Events List:

• 5140(S, F): A network share object was accessed.

• 5142(S): A network share object was added.

• 5143(S): A network share object was modified.

• 5144(S): A network share object was deleted.

• 5168(F): SPN check for SMB/SMB2 failed.