Problem:
A UCS@school server intended to operate as an EDU Replication Node (school replica) joins the domain incorrectly as a central replica, even though the correct role is configured in LDAP and visible on the computer object.
The issue is caused by the installation of the wrong UCS@school meta package (ucs-school-central-replica), which leads to incorrect join scripts being executed during the join process.
Even though the LDAP role of the server was correct, the join process executed the wrong join scripts.
Verification of the LDAP Role
On the Primary Directory Node, the computer object shows the correct UCS@school role:
root@ucs5primary:~# udm computers/domaincontroller_slave list --filter name="heisenberg" | grep "ucsschoolRole"
ucsschoolRole: dc_slave_edu:school:heisenberg
Despite this, the join process immediately indicated an incorrect role.
Evidence from join.log
During the join, the following entry could be found in /var/log/univention/join.log:
2026-01-19 15:14:29.548764819+01:00 (in joinscript_save_current_version)
Configure 62ucs-school-central-replica.inst Mon Jan 19 15:14:29 CET 2026
2026-01-19 15:14:29.561743460+01:00 (in joinscript_init)
This clearly shows that the ucs-school-central-replica join script was executed, which is incorrect for an EDU replication node.
Product and Version
- Univention Corporate Server (UCS) 5.x
- UCS@school 16.x
- Role: Domaincontroller Slave (EDU Replication Node)
Investigation
Pending Join Scripts
The join status check revealed several unconfigured join scripts:
root@school-replica:~# univention-check-join-status
Warning: 'ucs-school-central-replica' is not configured.
Warning: 'univention-nfs-server' is not configured.
Warning: 'univention-bind-post' is not configured.
Warning: 'univention-management-console-web-server' is not configured.
Warning: 'univention-pkgdb-tools' is not configured.
Error: Not all install files configured: 5 missing
This already indicates that the wrong UCS@school meta package is present on the system.
Installed Packages on the School Replica
A check of the installed replica-related packages shows that the server was previously installed or joined as a normal replica:
root@school-replica:~# dpkg -l | grep -i replica*
ii ucs-school-central-replica 16.0.0 all UCS@school meta package for central Replica Directory Nodes
ii univention-directory-replication 15.4.1 all UCS - Directory replication
ii univention-ldap-acl-slave 18.4.3 all UCS - LDAP server ACLs for Replica Directory Nodes.
ii univention-server-slave 17.4.0 all UCS - Replica Directory Node
The presence of ucs-school-central-replica is incorrect for an EDU replication node.
Root Cause:
During the join process, the LDAP attribute
univentionService=S4 SlavePDC
is set by the join script:
/usr/lib/univention-install/96univention-samba4.inst
This join script is provided by the package univention-samba4.
For UCS@school EDU replication nodes, the correct meta package is ucs-school-replica, which has an explicit dependency on univention-samba4.
Package Details: ucs-school-replica
root@heisenberg:~# dpkg -s ucs-school-replica
Package: ucs-school-replica
Status: install ok installed
Priority: optional
Section: univention
Installed-Size: 88
Maintainer: Univention GmbH <packages@univention.de>
Architecture: all
Source: ucs-school-metapackage
Version: 16.0.0
Depends: ... univention-samba4 (>= 8.0.0-32) | univention-samba (>= 13.0.0-11), univention-join (>= 12.0.0-7)
Description: UCS@school meta package for UCS Replica Directory Nodes
Package Details: ucs-school-central-replica
The wrongly installed package does not depend on univention-samba4:
root@ucs5replica:~# dpkg -s ucs-school-central-replica
Package: ucs-school-central-replica
Status: install ok installed
Priority: optional
Section: univention
Installed-Size: 49
Maintainer: Univention GmbH <packages@univention.de>
Architecture: all
Source: ucs-school-metapackage
Version: 16.0.0
Depends: python3-ucsschool-lib, shell-ucs-school (>= 5.0.38), univention-config, univention-join (>= 12.0.0-7)
Description: UCS@school meta package for central Replica Directory Nodes
As a result, the system is treated as a central replica, and the wrong join scripts are executed, even though the LDAP role is correct.
Solution
In-Place Fix (Recommended)
In most cases, it is sufficient to remove the incorrect meta package and rerun the join process.
- Remove the wrong package completely:
univention-remove --purge ucs-school-central-replica
- Execute the join process again:
univention-join
- Verify the join status:
univention-check-join-status
All join scripts should now be configured without errors.
- Verify that the correct package is installed:
dpkg -l | grep ucs-school-replica
Alternative Solution
If the system is newly installed or already heavily misconfigured, a full reinstallation may be the cleaner option:
- Reinstall the system
- Join it directly as an EDU server / school replica during setup
This avoids leftover configuration artifacts from an incorrect initial role.
Additional Information
Related discussion: