# OneAgent v1.277.165 on Win Srv 2019 v1809 generates thousands of logins to 445 SMB **URL:** \ **Category:** Open Q&A\ **Tags:** windows, oneagent\ **Created:** [November 30, 2023, 8:58am UTC](https://community.dynatrace.com/t/oneagent-v1-277-165-on-win-srv-2019-v1809-generates-thousands-of-logins-to-445-smb/42948 "2023-11-30T08:58:03Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![gilles\_tabary](https://avatars.discourse-cdn.com/v4/letter/g/eb9ed0/32.png) [@gilles\_tabary](https://community.dynatrace.com/u/gilles_tabary)\ **Post date:** [November 30, 2023, 8:58am UTC](https://community.dynatrace.com/t/oneagent-v1-277-165-on-win-srv-2019-v1809-generates-thousands-of-logins-to-445-smb/42948/1 "2023-11-30T08:58:03Z")
Hello. On a Windows box A (Windows Server 2019 Version 1809 OS Build 17763.5122), we upgraded OneAgent from 1.271.135.20230810-115019 to 1.277.165.20231024-150054 : we get thousands of network attempted logins from box A, with many local technical users, and many Active Directory recently connected users, to many Windows  targets machines on port 445 (SMB). Some times thousands per minute. Also toward Unix boxes. It is not constant. Happens some times for hour, sometime for minutes. It triggers alerts here. And stopped us to deploy this version on the parc. When we stop or rollback OneAgent : no problem any more. We tried intermédiate version : 1.275.146.20231002-095820 : looks like no problem in that case. We also tried latest OA version : 1.277.196 : same problem. Looks like brute force attack. Maybe attempting vulnerabilities exploit ? Any one exposed to that ? Any known solutions ? Regards. -- Tickets ref: Dynatrace: 250650 Private internal: Jira DEVOPS-15019 ---
**Author:** ![gilles\_tabary](https://avatars.discourse-cdn.com/v4/letter/g/eb9ed0/32.png) [@gilles\_tabary](https://community.dynatrace.com/u/gilles_tabary)\ **Post date:** [February 15, 2024, 12:08pm UTC](https://community.dynatrace.com/t/oneagent-v1-277-165-on-win-srv-2019-v1809-generates-thousands-of-logins-to-445-smb/42948/2 "2024-02-15T12:08:57Z")
Turns out - it can be mitigated by excluding network disk monitoring ```java Operating system: 'Windows', name: ''\\*\*' Operating system: 'Windows', name: '\\*' ``` - support says “we found a bug”