Only administrator accounts should have write permission to the UCMD Server product library, UNVPRD510; the command reference library, UNVCMDREF; the universal spool library, UNVSPL510 and all objects within these libraries. For maximum security, only trusted accounts (administrators and the UNVUBR510 profile) should have management, existence, alter, add, update, and delete authority to these objects. As a reminder, the system value QCRTAUT controls public access authority to created objects unless overridden by specific commands.
 
Other than users authorized to use Universal Agent components, the same applies to the product temporary library, UNVTMP510.

Only trusted user accounts should have write permission to the UCMD Server installation directory and subdirectories, and all of the files within them. This most likely means only the administrator group should have write access. Eligible users of Universal Command require read access to the message catalogs (*.umc files) in the nls subdirectory of the Universal Agent installation directory.
 
All eligible users of UCMD require permission to create directories in the UCMD Server working directory, if security is activated. A directory named after the user ID requesting the command is created for each user. The directory is created while impersonating the user; hence, it's created using the user's security account.
 
Home directories are created with permissions giving the user full control of both the directory and the files within the directory.

Only trusted user accounts should have write permission to the UCMD Server installation data sets. No general user access is required.

Although you may edit configuration files with any text editor (for example, Notepad), we recommend that you manage configuration options using the Universal Configuration Manager Control Panel application. Only user accounts in the Administrator group may execute the Universal Configuration Manager.

UCMD Server requires read access to its installation directory and its working directory (defined in the component definition). If user security is activated, the Server requires root access to create processes that execute with another user's identity. The Server security identity is inherited from the Broker. If the Broker is running with a non-root user ID, then the Server program must have the set user ID on execution permission set and root as owner. See Universal Message Translator for details.

UCMD Server for z/OS requires read access to its installation data sets and its HFS working directory (defined in the component definition).

If user security is activated, the UCMD Server for IBM i requires, by default, *ALLOBJ authority to change user profiles. Unless modifications are made (as described in Removing *ALLOBJ Authority from UNVUBR510 User Profile in the IBM i section of Universal Broker User Account in Universal Broker Security), the Server user profile, which is inherited from the Broker, requires *ALLOBJ authority.

Windows provides two primary types of log on processes: batch and interactive. A user must be given the right to log on as a batch job for them to do a batch log on. All users can do an interactive log on. See the LOGON_METHOD option for more details.

Universal Command can use three different types of user authentication methods:

1. Default authentication uses the UNIX traditional password comparison method.
2. PAM authentication uses the PAM API to authenticate users and, optionally, process session modules. This option is available only for certain UNIX platforms.
3. HP-UX Trusted Security uses HP-UX Trust Security APIs to authenticate users. This is available only on Hewlett Packard HP-UX and Tru64 platforms.

If the user name and password are successfully validated by the operating system, the Initiator program (UCMSINIT) changes the current user profile to the user profile of the user ID.