# Dynatrace now monitoring UNC Shares? **URL:** \ **Category:** Open Q&A\ **Tags:** problem-detection, problem-notification, anomaly-detection, problems-classic\ **Created:** [September 15, 2023, 7:16pm UTC](https://community.dynatrace.com/t/dynatrace-now-monitoring-unc-shares/41662 "2023-09-15T19:16:12Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Kenny\_Gillette](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/kenny_gillette/32/20170_2.png) [@Kenny\_Gillette](https://community.dynatrace.com/u/Kenny_Gillette)\ **Post date:** [September 15, 2023, 7:16pm UTC](https://community.dynatrace.com/t/dynatrace-now-monitoring-unc-shares/41662/1 "2023-09-15T19:16:12Z")
Team, Has anybody else seen that Dynatrace started monitoring UNC shares and alerting on it?  I looked through release notes and have not found anything (could have missed).  Our Product Specialist noticed this also started for another customer he is supporting at same time as it did for me.  Started around mid June. ![Kenny_Gillette_0-1694805134387.png](https://global.discourse-cdn.com/dynatrace/original/2X/3/307678e60c07717a0c6e37c4b140a62aa8a2e16e.png) I know how to filter out Unc shares by disk: \\* but just curious why Dynatrace started doing this.  This hurting other people? From DT Chat: now that you have mentioned it, one of my other customers had the same thing happening too. ---
**Author:** ![Kenny\_Gillette](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/kenny_gillette/32/20170_2.png) [@Kenny\_Gillette](https://community.dynatrace.com/u/Kenny_Gillette)\ **Post date:** [September 26, 2023, 7:06pm UTC](https://community.dynatrace.com/t/dynatrace-now-monitoring-unc-shares/41662/2 "2023-09-26T19:06:21Z")
From support: Based on feedback from our lab, this was the timeline of changes, and indeed some changes would have affected your cluster version: 1. Before OA 1.267, network drives were not monitored on Windows. 2. In OA 1.267, Windows network disk monitoring has been introduced. That’s why the network share metrics are showing up. 3. As soon as that version was rolled out to our customers, we discovered that the implementation was causing multiple problems, so we decided to disable it again with a debug flag temporarily. 4. We made multiple improvements, and the whole feature will be reenabled in OA 1.277. We hope this helps explain the situation. Going forward, if you do not want to have network drives monitoring, we can disable it by setting a debug flag. Alternatively, you can update OneAgent to a newer 1.267/1.271/1.273/1.275 version that just sets it by default. Please let us know which route you’d prefer to take, and if there are any questions. ---
**Author:** ![SrikanthSamraj](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@SrikanthSamraj](https://community.dynatrace.com/u/SrikanthSamraj)\ **Post date:** [January 11, 2024, 6:18am UTC](https://community.dynatrace.com/t/dynatrace-now-monitoring-unc-shares/41662/3 "2024-01-11T06:18:52Z")
I’m seeing this issue in our SaaS setup where OA agents are at 1.279.166 ---
**Author:** ![CuanP](https://avatars.discourse-cdn.com/v4/letter/c/c6cbf5/32.png) [@CuanP](https://community.dynatrace.com/u/CuanP)\ **Post date:** [February 2, 2024, 6:44am UTC](https://community.dynatrace.com/t/dynatrace-now-monitoring-unc-shares/41662/4 "2024-02-02T06:44:11Z")
Same here. ---
**Author:** ![Manas\_Dholakiya](https://avatars.discourse-cdn.com/v4/letter/m/df788c/32.png) [@Manas\_Dholakiya](https://community.dynatrace.com/u/Manas_Dholakiya)\ **Post date:** [March 5, 2024, 10:54am UTC](https://community.dynatrace.com/t/dynatrace-now-monitoring-unc-shares/41662/5 "2024-03-05T10:54:46Z")
same problem this is creating problem ---
**Author:** ![Manas\_Dholakiya](https://avatars.discourse-cdn.com/v4/letter/m/df788c/32.png) [@Manas\_Dholakiya](https://community.dynatrace.com/u/Manas_Dholakiya)\ **Post date:** [March 5, 2024, 10:56am UTC](https://community.dynatrace.com/t/dynatrace-now-monitoring-unc-shares/41662/6 "2024-03-05T10:56:51Z")
i am using 1.279.166 version and still we can see this problem ---
**Author:** ![SrikanthSamraj](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@SrikanthSamraj](https://community.dynatrace.com/u/SrikanthSamraj)\ **Post date:** [March 5, 2024, 11:15am UTC](https://community.dynatrace.com/t/dynatrace-now-monitoring-unc-shares/41662/7 "2024-03-05T11:15:39Z")
You can ask Dynatrace support to set below option globally. This approach worked for us. **‘debugEnableWindowsNetworkDriveMonitoring’ to false** I was told there would be fix available in oneagent version 1.285 so that user can do this themselves at host level ---
**Author:** ![sundarv1](https://avatars.discourse-cdn.com/v4/letter/s/65b543/32.png) [@sundarv1](https://community.dynatrace.com/u/sundarv1)\ **Post date:** [April 23, 2024, 5:23am UTC](https://community.dynatrace.com/t/dynatrace-now-monitoring-unc-shares/41662/8 "2024-04-23T05:23:52Z")
Hi Srikanth **debugEnableWindowsNetworkDriveMonitoring’ to false - where we need to do this. Could you please share steps how to set this parameter to false** ---
**Author:** ![SrikanthSamraj](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@SrikanthSamraj](https://community.dynatrace.com/u/SrikanthSamraj)\ **Post date:** [April 23, 2024, 10:39am UTC](https://community.dynatrace.com/t/dynatrace-now-monitoring-unc-shares/41662/9 "2024-04-23T10:39:20Z")
[@sundarv1](https://community.dynatrace.com/user/74312) - Hi, you can Dynatrace product support via a ticket to set this at the tenant level. OR 1. You can add regex in disk exclusion filter. (Settings --\> Preferences --\> Disk options) for windows OS. 2. At the alerting profile, you can filter it using description filter. In my case, I’ve used one like below as a safety net measure (until product support enabled the flag) Custom: Description not contains ‘The total available space on filesystem or disk \\’ ---
**Author:** ![sundarv1](https://avatars.discourse-cdn.com/v4/letter/s/65b543/32.png) [@sundarv1](https://community.dynatrace.com/u/sundarv1)\ **Post date:** [April 23, 2024, 1:29pm UTC](https://community.dynatrace.com/t/dynatrace-now-monitoring-unc-shares/41662/10 "2024-04-23T13:29:04Z")
Srikanth 1. You can add regex in disk exclusion filter. (Settings --\> Preferences --\> Disk options) for windows OS. - What we need to set here? Operating system - Windows , Disk or Mount path = \\* Is this setting fine ---
**Author:** ![Manas\_Dholakiya](https://avatars.discourse-cdn.com/v4/letter/m/df788c/32.png) [@Manas\_Dholakiya](https://community.dynatrace.com/u/Manas_Dholakiya)\ **Post date:** [April 23, 2024, 1:33pm UTC](https://community.dynatrace.com/t/dynatrace-now-monitoring-unc-shares/41662/11 "2024-04-23T13:33:10Z")
Yes that should work i have also fixed it with ![Manas_Dholakiya_0-1713879175048.png](https://global.discourse-cdn.com/dynatrace/original/2X/0/010e503aa970b62ec48670b5b5931f8b1b249d5c.png) ---
**Author:** ![gilles\_tabary](https://avatars.discourse-cdn.com/v4/letter/g/eb9ed0/32.png) [@gilles\_tabary](https://community.dynatrace.com/u/gilles_tabary)\ **Post date:** [August 27, 2024, 9:29am UTC](https://community.dynatrace.com/t/dynatrace-now-monitoring-unc-shares/41662/12 "2024-08-27T09:29:00Z")
Hi. Having had already excluded \\*\* and \\*,  Windows network drive monitoring we upgraded recently : - **from**  1.275 - **to**  1.293 =\> blam : issue : spurious user remote logins attempt detected, even some users get locked - pinpointing… - 1.277 I indeed see [windows-network-disk-monitoring-enabled](https://docs.dynatrace.com/docs/shortlink/release-notes-oneagent-sprint-277#windows-network-disk-monitoring-enabled) - 1.287 no issue until v1.287.149 - 1.289 issue starts with v1.289.113 Looking again on how to exclude Windows network disk monitoring… ---
**Author:** ![gilles\_tabary](https://avatars.discourse-cdn.com/v4/letter/g/eb9ed0/32.png) [@gilles\_tabary](https://community.dynatrace.com/u/gilles_tabary)\ **Post date:** [August 27, 2024, 12:38pm UTC](https://community.dynatrace.com/t/dynatrace-now-monitoring-unc-shares/41662/13 "2024-08-27T12:38:46Z")
When we activate “Disable NFS Disc monitoring” we stop our spurious network user attempted logon : fine. Because we don’t need the UNC / NFS / Network disk monitoring we \*can\* deactivate that. Though… it’s a bit fishy. :slightly\_smiling\_face: On a sample host our attempts at filtering out on OS==Windows pattern==\\*\* or \\* with FS Type == \* seams to not yield help. We did not find an other hack. I will report issue to support through a new ticket. ---
**Author:** ![gilles\_tabary](https://avatars.discourse-cdn.com/v4/letter/g/eb9ed0/32.png) [@gilles\_tabary](https://community.dynatrace.com/u/gilles_tabary)\ **Post date:** [September 3, 2024, 3:25pm UTC](https://community.dynatrace.com/t/dynatrace-now-monitoring-unc-shares/41662/14 "2024-09-03T15:25:08Z")
Hmmm. Documented @ [OneAgent 1.277 release notes : Windows - network disk monitoring enabled](https://docs.dynatrace.com/docs/shortlink/release-notes-oneagent-sprint-277#windows-network-disk-monitoring-enabled) : ```markup Note that this can create a security event log notifying that a process token was duplicated, but this is expected behavior and should not be interpreted as a security concern. ``` Support confirms **works as designed**. Scary though. :grimacing:🙂 Workaround indeed : “Disable NFS Disc monitoring” : makes OneAgent stop completely querying Windows perfmon API to get NFS discs infos. On the other hand, excluding UNC disc paths like \\* does **not** stop OA to query the API. Regards.