NetDocuments Download Threshold Exceeded


In 2016 someone hacked the Law Firm Mossack Fonseca and copied 11.4 million files, exposing details about the firm’s clients to the world.  NetDocuments has a setting that alerts you when documents are downloaded.


All repository administrations in NetDocuments will get an email like this:

“Internal user Wayne Jarvis (VAULT-T5C8B9IU) has downloaded more than 2000 documents in a single login session.  The login session began at 10/31/2020 11:59:00 AM, and the download threshold was exceeded at 10/31/2020 12:07:47 PM.”

NOTE: A User Session is 1.5 hours unless you are using federated ID/single sign-on, then it can be moved to 8 hours

Here are the actions that count toward the threshold:

  • Opening a document via the web interface.
  • Printing a document via the NetDocuments print option.
  • Viewing a PDF or HTML document (since we download the original document to the workstation rather than downloading a converted form).
  • Launching a document in a client side application (like Workshare).
  • Downloading a document (including the Mass Export utility).
  • Emailing a copy of a document. However emailing a document link (Email Link, Follow) is not counted.
  • Moving a document to a cabinet in a different repository.
  • Moving a document to a Sharespace that is in multiple cabinets.
  • Making a Sharespace that is currently accessible in just one cabinet accessible in another cabinet.
  • Opening or downloading a document via WebDAV.
  • The Download option.
  • Syncing a matter/folder with ndSync

Each time one of these actions is performed by a user during a single login session (even on the same document), it counts as a “download.”

When you get NetDocuments, the Download Threshold is set to 2000.  The maximum you can make is 999,999,999, which is shutting off the message since no one can download that amount in 1.5 hours.

NetDocuments has a product called ndSync, which syncs (downloads) documents to a user’s windows or mac.  This causes the Download Threshold warning to trigger.

If you have the download threshold set to 2000 or less and use ndSync, you are going to get a lot of emails telling you that someone is downloading documents.  I like knowing this information and checking in on employees.  If you don’t want the messages, change the download threshold to 999,999,999.