UCS 2.4 - Univention

8.4.5.4 Profile directory
8.4 Extended Configuration
The user profile for the Windows user interface is stored in the profile directory. In the Samba
configuration there is the parameter logon path, which under UCS is by default resolved to
\\\\windows-profiles\.
This directory is also used for storing the files which the user saves under Windows in the My documents
folder. Initially, these files are stored locally on the Windows computer; they are only stored on the drive of
the Samba server after the user has logged out of Windows.
The Univention Configuration Registry variable samba/profileserver can be used for specifying a
different server, the variable samba/profilepath for defining a different directory for logon path.
A different path or server for the user’s profile directory can be configured in the Windows Profile Path
entry field of Univention Directory Manager Example: \\ucs-file-server\meier\profiles\winXP.
If the path is changed at a later date, then a new profile directory will be created. The data in the old profile
directory will be kept. These data can be manually copied or moved to the new profile directory. Finally,
the old profile directory can be deleted.
Profiles stored on the server can be deactivated by setting the Univention Configuration Registry variables
samba/profilepath and samba/profileserver to local. The Samba service has to be restarted
after this procedure.
If further BDCs should be used alongside the PDC, this setting must also be performed on other systems.
8.4.5.5 Relative ID
All users, groups and processors within a Windows domain have a security ID (SID) consisting of two
parts. The first part is identical for all users and groups of the domain, and different from those of other
domains. The second part is used for distinguishing the users and groups within the domain. This part
is called relative ID (RID). Thus the overall SID is unique for each object. The RIDs from 0 to 999 are
reserved for standard groups and similar special objects.
8.4.5.6 Password characteristics for Windows clients
In Univention Directory Manager, specifications for user passwords can be defined regarding minimum
length, password quality and password history, via the policy Password. These presettings have an
indirect influence on passwords changed under Windows.
The background: Samba accepts password changes made by Windows clients, and passes them on to
the Univention Directory Manager. In Univention Directory Manager the policy Password is analysed;
if the policy is violated, say by a password consisting of too few characters, then the password change
is rejected. Samba returns to the Windows client the message: You are not authorised to change the
password.
To make it possible for Samba to return meaningful error messages to the client, some settings regarding
password properties can be made in the Samba configuration.
199