Direct answer
Event 5145 records an access check on a network share object. Review the requested access, subject and path, and correlate with other evidence before stating what happened to a file.
Read the access check
Microsoft describes event 5145 as a check to determine whether a client can receive requested access to a network share object. Capture the share, relative target, account, source, requested rights and outcome where available. Access checks can be frequent in normal operations.
Reference: Microsoft: Security event 5145.
Consider the workflow
Compare a backup service's repeated access checks with its schedule and expected paths. An interactive account requesting write access from an unfamiliar device may need further review. Access-check results must be interpreted alongside the user's intended role and effective file permissions.
Correlate and protect evidence
Use the timestamp and session context to find related share, logon or file events on the relevant systems. Restrict paths and account identifiers in shared reports, and avoid retrieving unrelated files. Note that a granted check does not necessarily show a successful write occurred.
Tune and verify
Work with the monitoring owner to select useful events and manage volume before broad deployment. If permissions are corrected, verify allowed and denied operations with dedicated accounts and harmless files. Recheck relevant evidence after the change and retain the approved exception history.
Assessment limits
A share access check is not a complete file-operation audit. Event volume, Windows policy and log retention can limit coverage.
Frequently asked questions
Does an allowed access check prove a file was changed?
No. It shows an access check; correlate separate operation evidence.
Can normal backups generate many events?
Yes. Interpret volume and requested rights against the approved backup workflow.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.