Consider the scenario of creating a Share on a host (that has 'Object Access - Audit File Share' enabled for Success only) and this generates an event ID 5143 "A Network Share Object was Modified" which contains the Share description in amongst the share information recorded (along with the Share name, and path).
A network share object was modified.
Subject:
Security ID: domain\username
Account Name: username
Account Domain: domain
Logon ID: 0x2726325f
Share Information:
Object Type: Directory
Share Name: \\*\Chicken
Share Path: D:\Chicken
Old Remark: Test Share - created locally on Host
New Remark: Test Share - created locally on Host
Old MaxUsers: 0xffffffff
New Maxusers: 0xffffffff
Old ShareFlags: 0x0
New ShareFlags: 0x0
Old SD: O:BAG:DUD:(A;;0x1200a9;;;WD)(A;;FA;;;BA)
New SD: O:BAG:DUD:(A;;0x1200a9;;;WD)(A;;FA;;;BA)
Can the new remark field be audited and made available to search results, and alerts/reports?