# Significance of "dtuser" for oneagentplugin.exe in dynatrace SaaS

**URL:** <https://community.dynatrace.com/t/significance-of-dtuser-for-oneagentplugin-exe-in-dynatrace-saas/22050>\
**Category:** Open Q&A\
**Tags:** account-management, dynatrace-saas, oneagent\
**Created:** [September 24, 2019, 10:40am UTC](https://community.dynatrace.com/t/significance-of-dtuser-for-oneagentplugin-exe-in-dynatrace-saas/22050 "2019-09-24T10:40:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![AK](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/ak/32/164_2.png) [@AK](https://community.dynatrace.com/u/AK)\
**Post date:** [September 24, 2019, 10:40am UTC](https://community.dynatrace.com/t/significance-of-dtuser-for-oneagentplugin-exe-in-dynatrace-saas/22050/1 "2019-09-24T10:40:59Z")

</div>

Hey Folks,

We observed that, there are five .exe processes getting installed after installing oneagent on windows host. Out of which one “oneagentplugin.exe” showing running with user “dtuser” and other are running with “SYSTEM” user.

Now our Security Team is questioning us, what is “dtuser” user and why its password set to never expire.

Can someone elaborate on this?

Thanks..

---

<div class="post-metadata">

**Author:** ![skrystosik](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/skrystosik/32/21133_2.png) [@skrystosik](https://community.dynatrace.com/u/skrystosik)\
**Post date:** [September 24, 2019, 10:47am UTC](https://community.dynatrace.com/t/significance-of-dtuser-for-oneagentplugin-exe-in-dynatrace-saas/22050/2 "2019-09-24T10:47:47Z")

</div>

duser is user created during agent installation. The same is for other OS’es and processes like Dynatrace Server, or ActiveGate. This is because agent should not work on admin/root user. It has it’s own on privviliges that it needs. Password never expires because agent does not have option to adapt to credential changes. This uses is only for agent process handling purposes.

Sebastian

---

<div class="post-metadata">

**Author:** ![bstewart](https://avatars.discourse-cdn.com/v4/letter/b/85f322/32.png) [@bstewart](https://community.dynatrace.com/u/bstewart)\
**Post date:** [September 24, 2019, 11:06am UTC](https://community.dynatrace.com/t/significance-of-dtuser-for-oneagentplugin-exe-in-dynatrace-saas/22050/3 "2019-09-24T11:06:54Z")

</div>

[@sebastian k.](https://answers.dynatrace.com/users/15061/view.html) Many sites’ security policies forbid local accounts. What is the recommendation for these cases?

Bill

---

<div class="post-metadata">

**Author:** ![skrystosik](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/skrystosik/32/21133_2.png) [@skrystosik](https://community.dynatrace.com/u/skrystosik)\
**Post date:** [September 24, 2019, 11:23am UTC](https://community.dynatrace.com/t/significance-of-dtuser-for-oneagentplugin-exe-in-dynatrace-saas/22050/4 "2019-09-24T11:23:00Z")

</div>

Here is answer for that case:

> **[Can we change the dynatrace service to use an AD service account instead of...](https://community.dynatrace.com/t5/Open-Q-A/Can-we-change-the-dynatrace-service-to-use-an-AD-service-account/m-p/123369)**
>
> Our security policy has flagged the dtuser local account on our servers. I have been tasked with finding a solution. It seems to me that the easiest way to remedy would be to create an AD service account and putting it in the "Performance Monitor...

There is option during agent installation described in docs but in such case you will not able to use OneAgent plugins. Those implemented by default in DT as well.

Sebastian