JDK 6 supports attach-on-demand. Thus jconsole can attach to a running VM and dynamically load the management agent which starts a JMX agent with a RMI connector for local monitoring (i.e. in the local machine). The dynamic attach mechanism only allows the same user (i.e. same uid and gid) who started a VM to attach to it. However, some application may want to disable the dynamic attach mechanism and disallow loading of a management agent for the following reason:

1. An application that already has its own JMX agent doesn't need another connector to be created for jconsole to attach. JConsole can connect to the application via the JMXServiceURL.

2. A server application which has its own user repository containing the users that are allowed to connect to and manage the server want to enforce its user authentication and access control. It wants to make sure only the users who are granted with permission can access the application MBeans.