Users who need to update accounts need to be in group "sponsor" and group "accounts" on cs-xh-admin.cs.private.uwaterloo.ca
That is, in those groups in the CS-GENERAL AD
Users who need to manipulate accounts, for example set passwords, in the cs-general region to be in the "accounts" group on cs-general.cs.private. Similarly for any other region.
Information in this area is meant for use by CSCF staff and is not official documentation, but anybody who is interested is welcome to use it if they find it useful.