As an FYI on a head-scratcher for my fellow JAMF'ers. I created an extension attribute based on local users. JAMF already inventoried the data, but not in a usable format for my needs. My EA was called "Local Users" using a script found on JAMF Nation. My Smart Group was based on matching specific criteria - in this case the logic was "is not: No Local Users"
Strangely it was reporting every single workstation in our environment was a member of this group (which they aren't). My EA was reporting properly, but apparently the Inventory Item of Local User Accounts was also populating a record, even though the EA was specifically chosen as criteria.
Changing the name of the EA from "Local Users" to "Prohibited Local Users" resolves this. I assume that my EA and the JAMF Inventory Item having similar names was the root of this based on the way a smart group reads the database. JAMF Support was as perplexed by this as I was, and only during a webex with them did I think this could be the cause of my issue and change the name, which resolved this. I'm curious if others have experienced this or not and I just happened to stumble upon this.
We saw the same thing, or something like it, happen when we upgraded from 8.73 to 9.6 late last year.
We had a FileVault 2 status EA that had the same name as the built in one. Prior to our upgrade, it never presented an issue. In the older JSS UI, it was actually easy to see which criteria item you were choosing since the EAs all showed up under a specific section. I can't say I care much for how all criteria items are lumped into one huge list now when selecting them. I kind of wish they were still separated into some logical grouping, but I digress...
We had to rename our FileVault 2 EA to prevent our Smart Groups from getting all weird on us. So, seems to be something that was introduced in the 9 series. I don't know what the underlying technical issue is, but just renaming it to something slightly different solves it, and isn't a bad idea anyway.