Consider what OS Configuration files can/should be managed:
passwd and group have a local "cscf-adm" account.
/etc/nsswitch.conf is configured:
files ahead of ldap or any other network service.
systemd-resolved configured:
adds extra resolver entry for CS adns.cs.uwaterloo.ca that is configured to use CS DynamicDNS for SRV zones and IST ADNS for everything else. NO local entries.
Information in this area is meant for use by CSCF staff and is not official documentation, but anybody who is interested is welcome to use it if they find it useful.