Google Chrome Keystone Updater removes /var symlink on systems that do not have SIP enabled causing boot & account problems.

Quick update if anyone missed the news today and have some machines in your enviorment that are having boot problems. Machines could still be in a bad state if they have Chrome set to auto update and have not rebooted or logged off.

https://mrmacintosh.com/google-chrome-keystone-is-modifying-var-symlink-on-non-sip-macs-causing-boot-issues/

I included an Extension Attribute that @rmanly & @neilmartin83 built and one that @franton made below to find machines that have a broken /var symlink.

#!/bin/zsh
# Run tests to see if var symlink is corrupted
vartest=$( ls -alO /var )
varuser=$( echo $vartest | awk '{ print $3 }' )
vargroup=$( echo $vartest | awk '{ print $4 }' )
varlink=$( echo $vartest | awk '{ print substr($0, index($0,$10)) }' )
​
# Compose results
[ "$varuser" != "root" ] && userresult=`/usr/bin/printf "
User: $varuser"`
[ "$vargroup" != "admin" ] && [ "$vargroup" != "wheel" ] && groupresult=`/usr/bin/printf "
Group: $vargroup"`
[ "$varlink" != "/var -> private/var" ] && linkresult=`/usr/bin/printf "Symlink: $varlink"`
result="$userresult$groupresult$linkresult"
​
# Output result
if [ -z "$result" ];
then
    echo "<result>No Issues</result>"
else
    echo "<result>$result</result>"
fi