NMAS relies on the storage of policies that are global to the NDS tree. The NDS tree is effectively the security domain. The security policies must be available to all servers in the tree.
NMAS places the authentication policies and login method configuration data in the Security container that is created off of the [Root] in NetWare® 5.1 NDS trees. This information must be readily accessible to all servers that are enabled for NMAS. The purpose of the Security container is to hold global policies that relate to security properties such as login, authentication, and key management.
With NMAS, we recommend that you create the Security container as a separate partition, and that the container be widely replicated. This partition should be replicated as a Read/Write partition only on those servers in your tree that are highly trusted.
NOTE: Because the Security container contains global policies, be careful where writable replicas are placed, because these servers can modify the overall security policies specified in the NDS tree. In order for users to log in with NMAS, replicas of the User objects must be on the NMAS server.