I recently started at a new org and noticed that a 0 byte Library folder and an orphaned Jamf log are located in /Applications (these are not hidden folders).
If I visit the "real" /private/var/log I do see a Jamf.log file that's up to date. The orphaned log at /Applications/private/var/log/jamf.log only has 2 entries recording a Slack app install that occurred during enrollment.
Has anyone seen similar behavior with typically hidden folders appearing in /Applications with no/orphaned content?
@sdagley Ahh, I hadn't thought of that because I usually avoid Composer. @donmontalvo The Mac I observed this behavior on is running 10.14.6, but this problem occurs in Catalina, as well.
Apparently Slack only provides a dmg installer, and the previous admin set the install policy Target Drive to be /Applications/ instead of the standard /. FUT and FEU were left unchecked, and it seems Jamf was putting the associated log files/receipts from the policy into those orphaned unhidden folders in /Applications.
I switched the Target Drive back to / and created my own Slack installer pkg, and problem solved.
Since my original post I found another typically hidden folder (/opt) appearing for all our users, but Jamf wasn't causing that issue. JumpCloud's "binding" script was running mkdir /opt so I had to add chflags hidden to get that to not appear to our users.
