So, I got bitten by the Mojave system user template permissions change/problem. The offending policies have been disabled and will be replaced so the problem isn't getting any worse, but is there any way to restore the original Apple made template on affected machines without completely rebuilding them? Given the multiple template tweaks accumulated over the years simply deleting only the changed files is impractical.
@joshuasee Only way I've found to fix this is to turn off SIP on the affected machines. No good for long term, but might help you solve it in the short term. Just boot into recovery and type csrutil disable into terminal to disable it.
Princeton Public Schools