Deny shell access for dtuser - Dynatrace Managed

Aboud1 — Mon, 05 Jan 2026 12:45:48 GMT

Hi,

We have a couple of questions regarding OneAgent and its default user behavior on Linux systems:

On all machines, the OneAgent processes are running under the user dtuser. As part of a security audit, we’re planning to deny shell access for dtuser (via usermod -s /sbin/nologin dtuser) without deleting the user.
👉 Could you please confirm if this change would impact OneAgent functionality or updates in any way?
On a few other machines, we noticed two users: dtuser and dynatrace.
👉 Is it possible that in older OneAgent versions, the user dynatrace was used by default instead of dtuser? Or is it likely that this user was manually created by someone else?

We'd appreciate any clarification to avoid disruption.

Thanks in advance

Re: dtuser deny access shell logon - Dynatrace Managed

Aboud1 — Fri, 01 Aug 2025 09:43:44 GMT

According to Dynatrace Support,

the default non-privileged user for OneAgent installations has been dtuser since at least version 1.195.
If the dynatrace user is present on some systems, it's not created by OneAgent by default, and it's very likely manually created or set up during a custom installation.
Dynatrace documentation does not mention dynatrace as a default user for OneAgent in any version.

topic Re: dtuser deny access shell logon - Dynatrace Managed in Dynatrace Managed Q&A

Deny shell access for dtuser - Dynatrace Managed

Re: dtuser deny access shell logon - Dynatrace Managed