Windows Security Log Event ID 5143

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
 • Subcategory
Object Access
 • File Share
Type Success
Corresponding events
in Windows 2003
and before

5143: A network share object was modified

On this page

A network share object was modified.

This event is new to Windows 2008 Release 2 and Windows 7. It does not appear in earlier versions of Windows.

The Remark field of the event appears as the "Comment" field in the advanced share properties window.

Free Security Log Resources by Randy

Description Fields in 5143

 Security ID:  %1
 Account Name:  %2
 Account Domain:  %3
 Logon ID:  %4

Share Information:
 Object Type:  %5
 Share Name:  %6
 Share Path:  %7
 Old Remark:  %8 - Remark or "Comment" before change 
 New Remark:  %9 - Remark or "Comment" after change 
 Old MaxUsers:  %10
 New Maxusers:  %11
 Old ShareFlags:  %12
 New ShareFlags:  %13
 Old SD:   %14
 New SD:   %15

Supercharger Free Edition

Supercharger's built-in Xpath filters leave the noise behind.



Examples of 5143

A network share object was modified.
 Security ID:  W8R2\wsmith
 Account Name:  wsmith
 Account Domain:  W8R2
 Logon ID:  0x475b7

Share Information:
 Object Type:  Directory
 Share Name:  \\*\AcmeAccounting
 Share Path:  C:\AcmeAccounting
 Old Remark:  N/A
 New Remark:  N/A
 Old MaxUsers:  0xffffffff
 New Maxusers:  0xffffffff
 Old ShareFlags:  0x0
 New ShareFlags:  0x800
 Old SD:   O:S-1-5-21-1850286605-2959700293-454930584-1104G:DUD:(A;OICI;FA;;;BA)(A;OICI;FA;;;WD)
 New SD:   O:S-1-5-21-1850286605-2959700293-454930584-1104G:DUD:(A;OICI;FA;;;BA)(A;OICI;FA;;;WD)

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources