<caution>

  <caution>

	<para>

	<para>

	  permissions for driver installation or the respective printer drivers

	  permissions for driver installation or the respective printer drivers

	  were stored on the printer server. If this is not the case, Windows

	  were stored on the printer server. If this is not the case, Windows

	  may issue an error warning that the permissions are insufficient to

	  may issue an error warning that the permissions are insufficient to

	  classifier. This compares an incoming e-mail with statistical data

	  classifier. This compares an incoming e-mail with statistical data

	  already gathered from processed e-mails and uses this to adapt it's

	  already gathered from processed e-mails and uses this to adapt it's

	  evaluation to the user's e-mail.

	  evaluation to the user's e-mail.

	  e-mails not identified as spam can be placed in the <emphasis>Spam</emphasis>

	  e-mails not identified as spam can be placed in the <emphasis>Spam</emphasis>

	  subfolder and a selection of legitimate e-mails copied into

	  subfolder and a selection of legitimate e-mails copied into

	  the <emphasis>Ham</emphasis> subfolder. This folder is evaluated daily and data

	  the <emphasis>Ham</emphasis> subfolder. This folder is evaluated daily and data

			  If the setting is <emphasis>no</emphasis>, it will not be

			  If the setting is <emphasis>no</emphasis>, it will not be

			  possible to read previous e-mails any more once the user's primary e-mail

			  possible to read previous e-mails any more once the user's primary e-mail

			  address is changed! If another user is assigned a previously used primary

			  address is changed! If another user is assigned a previously used primary

			</para>

			</para>

		  </listitem>

		  </listitem>

		</itemizedlist>

		</itemizedlist>

	<para>

	<para>

		Univention Corporate Server offers a cross platform domain concept with a

		Univention Corporate Server offers a cross platform domain concept with a

		common trust context between Linux and/or Windows systems. Within this domain

		common trust context between Linux and/or Windows systems. Within this domain

		system keeps the account synchronised for the windows log-in, Linux/POSIX

		system keeps the account synchronised for the windows log-in, Linux/POSIX

		systems and Kerberos. The management of user accounts is described in

		systems and Kerberos. The management of user accounts is described in

		<xref linkend="users:general"/>.

		<xref linkend="users:general"/>.

				The policy makes it possible to search for users and create an overview of all

				The policy makes it possible to search for users and create an overview of all

				the attributes of a user object. If an attempt is made to modify further

				the attributes of a user object. If an attempt is made to modify further

				attributes in addition to the password when the user does not have sufficient

				attributes in addition to the password when the user does not have sufficient

				message <emphasis>Permission denied</emphasis>.

				message <emphasis>Permission denied</emphasis>.

			</para>

			</para>

			<caution>

			<caution>

	  authentication information, which allows single sign-on across domain boundaries among other

	  authentication information, which allows single sign-on across domain boundaries among other

	  things. UCS provides a SAML identity provider: The external service (e.g., Salesforce) is then

	  things. UCS provides a SAML identity provider: The external service (e.g., Salesforce) is then

	  securely registered via a cryptographic certificate and trusts the identity provider. The

	  securely registered via a cryptographic certificate and trusts the identity provider. The

	  renewed authentication.

	  renewed authentication.

	</para>

	</para>

                            <para>

                            <para>

                                This selection field can be used to block individual login methods. This

                                This selection field can be used to block individual login methods. This

                                can happen automatically for security reasons, for example, if a user has

                                can happen automatically for security reasons, for example, if a user has

                            </para>

                            </para>

                            <para>

                            <para>

                                Normally users should always be blocked for all login methods.

                                Normally users should always be blocked for all login methods.

                    <row>

                    <row>

                        <entry>Change password on next login</entry>

                        <entry>Change password on next login</entry>

                        <entry>

                        <entry>

                            the next login procedure.

                            the next login procedure.

                        </entry>

                        </entry>

                    </row>

                    </row>

				<entry>

				<entry>

				  The period of time set for this must have at least

				  The period of time set for this must have at least

				  expired since the last password change before a user

				  expired since the last password change before a user

				</entry>

				</entry>

			  </row>

			  </row>

				<entry>

				<entry>

				  Once the saved period of time has elapsed, the

				  Once the saved period of time has elapsed, the

				  password must be changed again by the user the next

				  password must be changed again by the user the next

				  password is infinitely valid.

				  password is infinitely valid.

				</entry>

				</entry>

			  </row>

			  </row>

    <section id="user-management:Password_changes_by_users_via_UMC">

    <section id="user-management:Password_changes_by_users_via_UMC">

		<title>Password change by user via &ucsUMC;</title>

		<title>Password change by user via &ucsUMC;</title>

		<para>

		<para>

			<guimenu>Change password</guimenu> module. The module can also be opened

			<guimenu>Change password</guimenu> module. The module can also be opened

			by selecting the <guimenu>Settings &ar; Change password</guimenu>

			by selecting the <guimenu>Settings &ar; Change password</guimenu>

			entry in the top right user menu.

			entry in the top right user menu.

    <section id="users:faillog">

    <section id="users:faillog">

        <title>Automatic lockout of users after failed login attempts</title>

        <title>Automatic lockout of users after failed login attempts</title>

        <para>

        <para>

            hinder brute force attacks on passwords, an automatic lockout for user accounts

            hinder brute force attacks on passwords, an automatic lockout for user accounts

            can be activated after a configured number of failed log-in attempts. The lockout

            can be activated after a configured number of failed log-in attempts. The lockout

            is activated locally per computer system as standard. In other words, if a

            is activated locally per computer system as standard. In other words, if a

            still login on another system. Setting the &ucsUCRV; <envar>auth/faillog/lock_global</envar>

            still login on another system. Setting the &ucsUCRV; <envar>auth/faillog/lock_global</envar>

            will make the lock effective globally and register it in the LDAP. The global

            will make the lock effective globally and register it in the LDAP. The global

            lock can only be set on domain controller master/backup systems as other

            lock can only be set on domain controller master/backup systems as other

  UCS side on the Samba level alone. If a password change is initiated

  UCS side on the Samba level alone. If a password change is initiated

  by &ucsUDM;, but the password changed in Active Directory, the

  by &ucsUDM;, but the password changed in Active Directory, the

  expiration details for the Kerberos and POSIX passwords are not

  expiration details for the Kerberos and POSIX passwords are not

</para>

</para>

</listitem>

</listitem>

<listitem>

<listitem>

		<entry>

		<entry>

		  This username and its permissions and primary group is used for performing all the

		  This username and its permissions and primary group is used for performing all the

		  file operations of accessing users. The username is only used once the user has

		  file operations of accessing users. The username is only used once the user has

		  password. A common username is useful for using data in a shared way, yet

		  password. A common username is useful for using data in a shared way, yet

		  improper application might cause security problems.

		  improper application might cause security problems.

		</entry>

		</entry>