This security policy setting determines whether the operating system generates audit events when a file share is accessed.
Audit events are not generated when shares are created, deleted, or when share permissions change.
Note: There are no system access control lists (SACLs) for shares; therefore, once this setting is enabled, access to all shares on the system will be audited.
Combined with File System auditing, File Share auditing allows you to track what content was accessed, the source (IP address and port) of the request, and the user account used for the access.

Event volume: High on a file server or domain controller (due to SYSVOL access by client computers for policy processing)

If this policy setting is configured, the following events are generated. The events appear on computers running Windows Server 2008 R2 or Windows 7, unless otherwise noted.

• 5140: A network share object was accessed. (Note: This event is logged on computers running Windows Server 2008 R2, Windows Server 2008, Windows 7, or Windows Vista.)
• 5142: A network share object was added.
• 5143: A network share object was modified.
• 5144: A network share object was deleted.
• 5145: A network share object was checked to see whether the client can be granted desired access.
• 5168: SPN check for SMB/SMB2 failed.