9. Services for Windows

UCS can offer Active Directory (AD) services, be a member of an Active Directory domain or synchronize objects between Active Directory domains and a UCS domain.

For the purposes of Windows systems, UCS can assume the tasks of Windows server systems:

• Domain controller function / authentication services

• File services

• Print services

In UCS all these services are provided by Samba.

UCS supports the mostly automatic migration of an existing Active Directory domain to UCS. All users, groups, computer objects and group policies are migrated without the need to rejoin the Windows clients. This is documented in Migrating an Active Directory domain to UCS using Univention AD Takeover.

Microsoft Active Directory domain controllers cannot join the Samba domain. This functionality is planned at a later point in time.

Samba can not join an Active Directory Forest yet at this point.

Incoming trust relationships with other Active Directory domains are configurable. In this setup the external Active Directory domain trusts authentication decisions of the UCS domain (Windows trusts UCS) so that UCS users can sign in to systems and Active Directory backed services in the Windows domain (see Trust relationships). Outgoing trusts with Active Directory domain (UCS trusts Windows) are not supported currently.

Chapter contents:

• 9.1. Operation of a Samba domain based on Active Directory
  • 9.1.1. Installation
  • 9.1.2. Services of a Samba domain
    • 9.1.2.1. Authentication services
    • 9.1.2.2. File services
    • 9.1.2.3. Print services
    • 9.1.2.4. Univention S4 connector
    • 9.1.2.5. Replication of directory data
    • 9.1.2.6. Synchronization of the SYSVOL share
  • 9.1.3. Configuration and management of Windows desktops
    • 9.1.3.1. Group policies
      • Installation of Group Policy Management
      • Configuration of policies with Group Policy Management
      • Configuration of group policies in environments with more than one Samba domain controller
      • Administrative templates (ADMX/ADM)
      • Application of policies based on computer properties (WMI filters)
    • 9.1.3.2. Logon scripts / NETLOGON share
    • 9.1.3.3. Configuration of the file server for the home directory
    • 9.1.3.4. Roaming profiles
• 9.2. Active Directory Connection
  • 9.2.1. UCS as a member of an Active Directory domain
  • 9.2.2. Setup of the UCS AD connector
    • 9.2.2.1. Basic configuration of the UCS AD Connector
    • 9.2.2.2. Importing the SSL certificate of the Active Directory
      • Exporting the certificate on Windows 2012 / 2016 / 2019 / 2022
      • Copying the Active Directory certificate to the UCS system
    • 9.2.2.3. Starting/Stopping the Active Directory Connection
    • 9.2.2.4. Functional test of basic settings
    • 9.2.2.5. Changing the AD access password
  • 9.2.3. Additional tools / Debugging connector problems
  • 9.2.4. Selective synchronization
    • 9.2.4.1. Allow only specific LDAP subtrees
    • 9.2.4.2. Allow only objects that match an LDAP filter
    • 9.2.4.3. Ignore objects from specific LDAP subtrees
    • 9.2.4.4. Ignore objects by LDAP filter
    • 9.2.4.5. Priority of allow and ignore rules
  • 9.2.5. Details on preconfigured synchronization
    • 9.2.5.1. Containers and organizational units
    • 9.2.5.2. Groups
      • Particularities
      • Custom mappings
    • 9.2.5.3. Users
• 9.3. Migrating an Active Directory domain to UCS using Univention AD Takeover
  • 9.3.1. Preparation
  • 9.3.2. Domain migration
  • 9.3.3. Final steps of the takeover
  • 9.3.4. Tests
• 9.4. Trust relationships