AD Bound managed Macs get profile in / (root)

I haven't seen this happen, but want to suggest working backwards from the folder creation timestamp. Check policy logs for the affected endpoint etc. It seems odd that Photoshop Elements 14 is in the root directory also, could be another avenue to investigate..

@scott.borcherdt The Elements was an issue where she just dropped the .dmg into JAMF Admin-that was a learning moment on her test box. This is happening all over their Site without the Elements element.

The folder creation timestamp coincides with when the user authenticates via AD.

It is as if some sort of mapping bit got flipped but I am not sure where to look or where I might set it.

/randy

By chance have they configured a Mobility payload in a configuration profile? Maybe someone inadvertently changed the "at path" for the home folder location.

OK,

I narrowed it down to one of their policies that called three scripts. I took notes about that policy and then deleted it. Then I recreated it and added each of the scripts back one at a time until it started to occur again. Turns out it is the following script that I borrowed from @rtrouton's Github.

The script goes deeper in the weeds that I am able to grok with my scripting knowledge so I am not sure what the actual cause is:

#!/bin/bash

# Determine OS version
osvers=$(sw_vers -productVersion | awk -F. '{print $2}')
sw_vers=$(sw_vers -productVersion)

# Determine OS build number

sw_build=$(sw_vers -buildVersion)

# Checks first to see if the Mac is running 10.7.0 or higher. 
# If so, the script checks the system default user template
# for the presence of the Library/Preferences directory. Once
# found, the iCloud, Diagnostic and Siri pop-up settings are set 
# to be disabled.

if [[ ${osvers} -ge 7 ]]; then

 for USER_TEMPLATE in "$3/System/Library/User Template"/*
  do
    /usr/bin/defaults write "${USER_TEMPLATE}"/Library/Preferences/com.apple.SetupAssistant DidSeeCloudSetup -bool TRUE
    /usr/bin/defaults write "${USER_TEMPLATE}"/Library/Preferences/com.apple.SetupAssistant GestureMovieSeen none
    /usr/bin/defaults write "${USER_TEMPLATE}"/Library/Preferences/com.apple.SetupAssistant LastSeenCloudProductVersion "${sw_vers}"
    /usr/bin/defaults write "${USER_TEMPLATE}"/Library/Preferences/com.apple.SetupAssistant LastSeenBuddyBuildVersion "${sw_build}"
    /usr/bin/defaults write "${USER_TEMPLATE}"/Library/Preferences/com.apple.SetupAssistant DidSeeSiriSetup -bool TRUE    
    /usr/bin/defaults write "${USER_TEMPLATE}"/Library/Preferences/com.apple.SetupAssistant DidSeeCloudDiagnostics -bool TRUE
  done

 # Checks first to see if the Mac is running 10.7.0 or higher.
 # If so, the script checks the existing user folders in /Users
 # for the presence of the Library/Preferences directory.
 #
 # If the directory is not found, it is created and then the
 # iCloud, Diagnostic and Siri pop-up settings are set to be disabled.

 for USER_HOME in "$3/Users"/*
  do
    USER_UID=`basename "${USER_HOME}"`
    if [ ! "${USER_UID}" = "Shared" ]; then
      if [ ! -d "${USER_HOME}"/Library/Preferences ]; then
        /bin/mkdir -p "${USER_HOME}"/Library/Preferences
        /usr/sbin/chown "${USER_UID}" "${USER_HOME}"/Library
        /usr/sbin/chown "${USER_UID}" "${USER_HOME}"/Library/Preferences
      fi
      if [ -d "${USER_HOME}"/Library/Preferences ]; then
        /usr/bin/defaults write "${USER_HOME}"/Library/Preferences/com.apple.SetupAssistant DidSeeCloudSetup -bool TRUE
        /usr/bin/defaults write "${USER_HOME}"/Library/Preferences/com.apple.SetupAssistant GestureMovieSeen none
        /usr/bin/defaults write "${USER_HOME}"/Library/Preferences/com.apple.SetupAssistant LastSeenCloudProductVersion "${sw_vers}"
        /usr/bin/defaults write "${USER_HOME}"/Library/Preferences/com.apple.SetupAssistant LastSeenBuddyBuildVersion "${sw_build}"
        /usr/bin/defaults write "${USER_HOME}"/Library/Preferences/com.apple.SetupAssistant DidSeeSiriSetup -bool TRUE
        /usr/bin/defaults write "${USER_TEMPLATE}"/Library/Preferences/com.apple.SetupAssistant DidSeeCloudDiagnostics -bool TRUE
        /usr/sbin/chown "${USER_UID}" "${USER_HOME}"/Library/Preferences/com.apple.SetupAssistant.plist
      fi
    fi
  done
fi

exit 0
#!/bin/sh

@Randydid If you look inside the home folder in root, do you only see a "Library' folder inside it, or do you see all the normal folders you usually have in a user directory?
The problem I think is the $3 in front of /Users/ That doesn't seem to be in the original script on @rtrouton's github. Was that added to the script? The reason I ask is because the $3 in the script will be resolving to the username if it's being run by a jamf policy, so I think it's messing up the path to the user directories and this line - /bin/mkdir -p "${USER_HOME}"/Library/Preferences is just creating a user folder with only the Library folder in it.