University Active Directory (AD) Service

ITSC manage the University Active Directory (CUHKAD) and provide the following key features:

• Managed Infrastructure: ITSC manage and support the Windows AD infrastructure including domain controllers and ADFS. They also monitor the environment 24/7 and provide a secure environment for domain controllers. The savings for departments in asset costs and support staff overhead can be significant.
• Centralized and Automated Account Management: Staff and student accounts creation and termination are based on Human Resources (CUPIS) and Student (CUSIS) records data. Account passwords integrate with OnePass passwords. Groups created and maintained are for common use.
• Authentication and Authorization: It supports the use of CUHK accounts, including accounts of all staff and students, for authentication and authorization.
• Consistent experience provided across campus: Staff and students can use the same CUHK accounts to login to University AD joined computer laboratory. For example, a student can use the same CUHK account to login the PC systems in User Area (1/F Pi Chiu Building), Learning Commons (6/F Wu Ho Man Yuan Building) and also the University AD joined computers provided by her department.
• Delegation of Administration: Once participated, department IT administrators will have control on their departmental AD OU. They can create local groups, assign group policies, deploy software, and apply updates to their computers participating in AD.
• Increased Security: Participating departments are required to follow best security practices in using and managing the domain-joined systems. These include granting CUHK accounts with a normal user right without admin privilege, randomization of the password of local admin account and the use of Privileged Access Workstation (PAW) for AD administrative works.

The documents below are viewable via CUHK Login on top of Campus Network or CUHK / SSL VPN

• CUHKAD – Introduction and Service Request Guide
• CUHKAD – Object Naming Conventions
• CUHKAD – Office 365 Distribution Group and Contact Creation
• CUHKAD – OU Structures and Permissions
• CUHKAD – Procedures for Joining Servers and Desktops to Domain
• CUHKAD – Group Policy Object Creation
• CUHKAD – Zero Client and Privilege Access Workstation – User Guide
• CUHKAD – Procedures to grant GPO Full Control Permission and Import GPO
• CUHKAD (Active Directory) Group (Request for Information)
• System Center Configuration Manager (SCCM) Client Deployment Introduction

• Advantages of Joining CUHKAD Workshop
• Microsoft System Center Configuration Manager (SCCM)
• Microsoft Local Administrator Password Solution (LAPS) and BitLocker