I haven't seen this happen, but want to suggest working backwards from
the folder creation timestamp. Check policy logs for the affected
endpoint etc. It seems odd that Photoshop Elements 14 is in the root
directory also, could be another avenue to i...
Create a policy to run sudo jamf log (or rather just 'jamf log' as it
runs as root anyway) with a login trigger. This will update the current
username without doing a complete recon.
