Home

User tsninja - created on MacBook Pro after installing Teams

%3CLINGO-SUB%20id%3D%22lingo-sub-330772%22%20slang%3D%22en-US%22%3EUser%20tsninja%20-%20created%20on%20MacBook%20Pro%20after%20installing%20Teams%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-330772%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EDoes%20MS%20Teams%20create%20a%20hidden%20user%20account%20on%20a%20mac%20called%20tsninja%20containing%20Azure%20framework%20files%3F%20I%20just%20discovered%20this%20account%2C%20deleted%20it%20and%20it%20was%20recreated%20when%20I%20relaunched%20Teams.%20I%20am%20running%20a%20local%20copy%20of%20Teams%20with%20one%20Team%20set%20up%20for%20which%20I%20am%20the%20admin.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EI%20discovered%20this%20a%20couple%20of%20days%20ago%20and%20it%20looked%20like%20Malware.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71978iE8E05085DF8C9A17%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Screenshot%202019-02-01%20at%2012.48.38.png%22%20title%3D%22Screenshot%202019-02-01%20at%2012.48.38.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EFurther%20investigation%20showed%20this%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71977i7F30B5F7B4B4007F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Screenshot%202019-02-01%20at%2012.53.37.png%22%20title%3D%22Screenshot%202019-02-01%20at%2012.53.37.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-330772%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EMicrosoft%20Teams%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-363330%22%20slang%3D%22en-US%22%3ERe%3A%20User%20tsninja%20-%20created%20on%20MacBook%20Pro%20after%20installing%20Teams%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-363330%22%20slang%3D%22en-US%22%3E%3CP%3EWhat%20are%20the%20other%20conditions%26nbsp%3Bto%20your%20issue%3F%20I'm%20a%20Mac%20User%20and%20I%26nbsp%3Bhave%20been%20using%20Teams%20for%20months.%20That%20account%20has%20never%20been%20on%20my%20Mac.%20See%20screenshot%20below.%20Is%20your%20mac%20authentication%20to%20your%20AD%3F%20Does%20you%20Ad%20apply%20policies%20or%20profiles%20when%20setting%20up%20or%20logging%20into%26nbsp%3BOffice365%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20496px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F86179i5CA777766094F4E6%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Screen%20Shot%202019-03-08%20at%209.16.38%20AM.png%22%20title%3D%22Screen%20Shot%202019-03-08%20at%209.16.38%20AM.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20looks%20like%20it%20is%20installing%20a%20vsts-agent%20on%20your%20mac%20to%20support%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fdevops%2Fpipelines%2Fagents%2Fagents%3Fview%3Dazure-devops%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20Pipelines%20to%20allow%20continuous%26nbsp%3Bupdating%20of%20the%20client.%26nbsp%3B%20Do%20you%20have%20Office%20Insider%20turned%20on%3F%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-360544%22%20slang%3D%22en-US%22%3ERe%3A%20User%20tsninja%20-%20created%20on%20MacBook%20Pro%20after%20installing%20Teams%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-360544%22%20slang%3D%22en-US%22%3E%3CP%3EEngineering%20is%20still%20looking%20into%20the%20issue.%26nbsp%3B%20This%20thread%20is%20noted%20in%20the%20work%20item%20and%20I'll%20ask%20that%20when%20resolved%20we%20follow%20up%20here.%20%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-360346%22%20slang%3D%22en-US%22%3ERe%3A%20User%20tsninja%20-%20created%20on%20MacBook%20Pro%20after%20installing%20Teams%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-360346%22%20slang%3D%22en-US%22%3E%3CP%3EI've%20been%20working%20with%20some%20of%20the%20engineers%20to%20try%20and%20get%20to%20the%20bottom%20of%20it%2C%20but%20no%20joy%20as%20yet.%20I%20have%20some%20more%20things%20they've%20asked%20me%20to%20try%2C%20and%20I%20will%20send%20them%20the%20results%20as%20soon%20as%20possible%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-360343%22%20slang%3D%22en-US%22%3ERe%3A%20User%20tsninja%20-%20created%20on%20MacBook%20Pro%20after%20installing%20Teams%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-360343%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F85%22%20target%3D%22_blank%22%3E%40Jamie%20Stark%3C%2FA%3E%26nbsp%3Bany%20news%20on%20the%20subject%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20Teams%20keeps%20crashing%20because%20it%20cannot%20create%20the%20user%20any%20more.%20Dtrace%20looks%20like%20this%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3Emkdir(%22%2FUsers%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%2317%3CBR%20%2F%3Emkdir(%22%2FUsers%2Ftsninja%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%2313%3CBR%20%2F%3Emkdir(%22%2FUsers%2Ftsninja%2Fvsts-agent%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%232%3CBR%20%2F%3Emkdir(%22%2FUsers%2Ftsninja%2Fvsts-agent%2F_work%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%232%3CBR%20%2F%3Emkdir(%22%2FUsers%2Ftsninja%2Fvsts-agent%2F_work%2F22%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%232%3CBR%20%2F%3Emkdir(%22%2FUsers%2Ftsninja%2Fvsts-agent%2F_work%2F22%2Fs%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%232%3CBR%20%2F%3Emkdir(%22%2FUsers%2Ftsninja%2Fvsts-agent%2F_work%2F22%2Fs%2Fadal%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%232%3CBR%20%2F%3Emkdir(%22%2FUsers%2Ftsninja%2Fvsts-agent%2F_work%2F22%2Fs%2Fadal%2Fmac%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%232%3CBR%20%2F%3Emkdir(%22%2FUsers%2Ftsninja%2Fvsts-agent%2F_work%2F22%2Fs%2Fadal%2Fmac%2Foutput%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%232%3CBR%20%2F%3Emkdir(%22%2FUsers%2Ftsninja%2Fvsts-agent%2F_work%2F22%2Fs%2Fadal%2Fmac%2Foutput%2Fadalbuild%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%232%3CBR%20%2F%3Emkdir(%22%2FUsers%2Ftsninja%2Fvsts-agent%2F_work%2F22%2Fs%2Fadal%2Fmac%2Foutput%2Fadalbuild%2FBuild%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%232%3CBR%20%2F%3Emkdir(%22%2FUsers%2Ftsninja%2Fvsts-agent%2F_work%2F22%2Fs%2Fadal%2Fmac%2Foutput%2Fadalbuild%2FBuild%2FIntermediates.noindex%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%232%3CBR%20%2F%3Emkdir(%22%2FUsers%2Ftsninja%2Fvsts-agent%2F_work%2F22%2Fs%2Fadal%2Fmac%2Foutput%2Fadalbuild%2FBuild%2FIntermediates.noindex%2FADAL.build%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%232%3CBR%20%2F%3Emkdir(%22%2FUsers%2Ftsninja%2Fvsts-agent%2F_work%2F22%2Fs%2Fadal%2Fmac%2Foutput%2Fadalbuild%2FBuild%2FIntermediates.noindex%2FADAL.build%2FRelease%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%232%3CBR%20%2F%3Emkdir(%22%2FUsers%2Ftsninja%2Fvsts-agent%2F_work%2F22%2Fs%2Fadal%2Fmac%2Foutput%2Fadalbuild%2FBuild%2FIntermediates.noindex%2FADAL.build%2FRelease%2FADAL%20Mac.build%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%232%3CBR%20%2F%3Emkdir(%22%2FUsers%2Ftsninja%2Fvsts-agent%2F_work%2F22%2Fs%2Fadal%2Fmac%2Foutput%2Fadalbuild%2FBuild%2FIntermediates.noindex%2FADAL.build%2FRelease%2FADAL%20Mac.build%2FObjects-normal%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%232%3CBR%20%2F%3Emkdir(%22%2FUsers%2Ftsninja%2Fvsts-agent%2F_work%2F22%2Fs%2Fadal%2Fmac%2Foutput%2Fadalbuild%2FBuild%2FIntermediates.noindex%2FADAL.build%2FRelease%2FADAL%20Mac.build%2FObjects-normal%2Fx86_64%5C0%22%2C%200x1ED%2C%200x0)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%232%3CBR%20%2F%3Eopen(%22%2FUsers%2Ftsninja%2Fvsts-agent%2F_work%2F22%2Fs%2Fadal%2Fmac%2Foutput%2Fadalbuild%2FBuild%2FIntermediates.noindex%2FADAL.build%2FRelease%2FADAL%20Mac.build%2FObjects-normal%2Fx86_64%2FADAggregatedDispatcher.gcda%5C0%22%2C%200x202%2C%200x1A4)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20-1%20Err%232%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-331185%22%20slang%3D%22en-US%22%3ERe%3A%20User%20tsninja%20-%20created%20on%20MacBook%20Pro%20after%20installing%20Teams%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-331185%22%20slang%3D%22en-US%22%3E%3CP%3ELet%20me%20ask%20around.....%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-330786%22%20slang%3D%22en-US%22%3ERe%3A%20User%20tsninja%20-%20created%20on%20MacBook%20Pro%20after%20installing%20Teams%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-330786%22%20slang%3D%22en-US%22%3EYes%20-%20that's%20what%20spooked%20me%20in%20the%20first%20place.%20It's%20clearly%20not%20a%20'real'%20user%20because%20when%20I%20deleted%20it%2C%20it%20didn't%20put%20up%20a%20fight.%20No%20password%20requested%20-%20unusual%20for%20a%20user%20account.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-330784%22%20slang%3D%22en-US%22%3ERe%3A%20User%20tsninja%20-%20created%20on%20MacBook%20Pro%20after%20installing%20Teams%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-330784%22%20slang%3D%22en-US%22%3EThat%20name%20too%20%3Aface_with_tears_of_joy%3A%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-330779%22%20slang%3D%22en-US%22%3ERe%3A%20User%20tsninja%20-%20created%20on%20MacBook%20Pro%20after%20installing%20Teams%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-330779%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F278434%22%20target%3D%22_blank%22%3E%40allygill%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EInteresting%20question.%20I%20would%20assume%20so%20given%20that%20it%20reappeared%20after%20you%20reloaded%20the%20Teams%20Client.%20However%2C%20it%20would%20be%20good%20to%20get%20confirmation%20from%20Microsoft.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECan't%20find%20anything%20online%20or%20on%20the%20Tech%20Community.%20Personally%20I've%20never%20come%20across%20it%20before%20-%20but%20then%20again%20I%20use%20a%20Surface%20not%20a%20Mac.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F85%22%20target%3D%22_blank%22%3E%40Jamie%20Stark%3C%2FA%3Ecan%20you%20confirm%20this%20question%3F%20Does%20the%20Teams%20Client%20on%20Mac%20create%20the%20following%20user%20TSNinja%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBest%2C%20Chris%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-691683%22%20slang%3D%22en-US%22%3ERe%3A%20User%20tsninja%20-%20created%20on%20MacBook%20Pro%20after%20installing%20Teams%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-691683%22%20slang%3D%22en-US%22%3E%3CP%3EI%20too%20have%20a%20tsninja%20user%20created%20on%20my%20mac.%20I%20see%20there%20has%20been%20no%20updates%20to%20this%20thread.%20Can%20anyone%20dig%20into%20this%20and%20respond%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3CBLOCKQUOTE%3E%3CHR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F278434%22%20target%3D%22_blank%22%3E%40allygill%3C%2FA%3E%26nbsp%3Bwrote%3A%3CBR%20%2F%3E%3CP%3E%3CSPAN%3EDoes%20MS%20Teams%20create%20a%20hidden%20user%20account%20on%20a%20mac%20called%20tsninja%20containing%20Azure%20framework%20files%3F%20I%20just%20discovered%20this%20account%2C%20deleted%20it%20and%20it%20was%20recreated%20when%20I%20relaunched%20Teams.%20I%20am%20running%20a%20local%20copy%20of%20Teams%20with%20one%20Team%20set%20up%20for%20which%20I%20am%20the%20admin.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EI%20discovered%20this%20a%20couple%20of%20days%20ago%20and%20it%20looked%20like%20Malware.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71978iE8E05085DF8C9A17%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Screenshot%202019-02-01%20at%2012.48.38.png%22%20title%3D%22Screenshot%202019-02-01%20at%2012.48.38.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EFurther%20investigation%20showed%20this%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71977i7F30B5F7B4B4007F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Screenshot%202019-02-01%20at%2012.53.37.png%22%20title%3D%22Screenshot%202019-02-01%20at%2012.53.37.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%3CHR%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-724690%22%20slang%3D%22en-US%22%3ERe%3A%20User%20tsninja%20-%20created%20on%20MacBook%20Pro%20after%20installing%20Teams%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-724690%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F278434%22%20target%3D%22_blank%22%3E%40allygill%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20just%20noticed%20I've%20got%20a%20tsninja%20account%20created%20too!%3C%2FP%3E%3CP%3EAre%20there%20any%20updates%20from%20MS%20on%20why%20this%20is%20being%20created%2C%20if%20it%20is%20directly%20linked%20to%20Teams%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-734628%22%20slang%3D%22en-US%22%3ERe%3A%20User%20tsninja%20-%20created%20on%20MacBook%20Pro%20after%20installing%20Teams%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-734628%22%20slang%3D%22en-US%22%3E%3CP%3EMy%20organization%20has%20been%20having%20trouble%20using%20teams%3B%20while%20we%20don't%20have%20tsninja%20accounts%20appearing%20on%20our%20devices%20if%20you%20launch%20Teams.app%20from%20Terminal%20you%20will%20get%20a%20multiple%20errors%20when%20it%20quits%20to%20the%20effect%20of%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eprofiling%3A%20%2FUsers%2Ftsninja%2Fvsts-agent%2F_work%2F22%2Fs%2Fadal%2Fmac%2Foutput%2Fadalbuild%2FBuild%2FIntermediates.noindex%2FADAL.build%2FRelease%2FADAL%20Mac.build%2FObjects-normal%2Fx86_64%2F*.gcda%3A%20cannot%20open%3A%20No%20such%20file%20or%20directory%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhere%20*%20is%20the%20following%3A%3C%2FP%3E%3CP%3EADAggregatedDispatcher%20%2C%20ADTokenCacheItem%20%2C%20ADNegotiateHandler%20%2C%20ADTelemetryHttpEvent%20%2C%20ADAuthenticationViewController%20%2C%20ADTelemetryAPIEvent%20%2C%20ADWebAuthController%20%2C%20ADAuthenticationContext%20%2C%20ADWebAuthResponse%20%2C%20ADAuthenticationRequest%20%2C%20ADUserIdentifier%20%2C%20ADTelemetry%20%2C%20ADTokenCacheItem%2BInternal%20%2C%20ADNTLMHandler%20%2C%20ADAuthenticationParameters%2BInternal%20%2C%20NSUUID%2BADExtensions%20%2C%20ADAuthenticationError%20%2C%20ADTelemetryEventStrings%20%2C%20NSString%2BADHelperMethods%20%2C%20ADJwtHelper%20%2C%20NSURL%2BADExtensions%20%2C%20ADAuthenticationSettings%20%2C%20ADCredentialCollectionController%20%2C%20ADTokenCache%20%2C%20ADWorkPlaceJoinConstants%20%2C%20ADTelemetryCollectionRules%20%2C%20ADAuthenticationRequest%2BAcquireAssertion%20%2C%20ADLogger%20%2C%20ADClientMetrics%20%2C%20ADWorkPlaceJoinUtil%20%2C%20ADRegistrationInformation%20%2C%20ADAuthorityValidationRequest%20%2C%20ADTelemetryBrokerEvent%20%2C%20ADALFrameworkUtils%20%2C%20ADCustomHeaderHandler%20%2C%20ADTokenCacheKey%20%2C%20ADPkeyAuthHelper%20%2C%20ADBrokerHelper%20%2C%20ADTelemetryDefaultEvent%20%2C%20ADDefaultDispatcher%20%2C%20NSMutableDictionary%2BADExtensions%20%2C%20ADURLProtocol%20%2C%20ADAuthenticationRequest%2BAcquireToken%20%2C%20ADAuthenticationParameters%20%2C%20NSDictionary%2BADExtensions%20%2C%20ADNTLMUIPrompt%20%2C%20ADURLSessionDemux%20%2C%20ADAuthenticationResult%2BInternal%20%2C%20ADAcquireTokenSilentHandler%20%2C%20ADAuthenticationRequest%2BBroker%20%2C%20ADUserInformation%20%2C%20ADTokenCacheAccessor%20%2C%20ADClientCertAuthHandler%20%2C%20ADWebFingerRequest%20%2C%20ADTelemetryUIEvent%20%2C%20ADWebRequest%20%2C%20ADTelemetryCacheEvent%20%2C%20ADAuthorityValidation%20%2C%20ADDrsDiscoveryRequest%20%2C%20ADWebResponse%20%2C%20ADOAuth2Constants%20%2C%20ADRequestParameters%20%2C%20ADAuthenticationResult%20%2C%20ADIpAddressHelper%20%2C%20ADAuthenticationContext%2BInternal%20%2C%20ADWebAuthRequest%20%2C%20ADHelpers%20%2C%20ADAuthenticationRequest%2BWebRequest%20%2C%20ADAL_vers%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMy%20guess%20is%20this%20is%20some%20kind%20of%20debugging%20code.%20I'm%20tempted%20to%20create%20the%20folder%20heirarchy%20and%20see%20what%20happens%2C%20since%20it%20sounds%20like%20some%20of%20you%20are%20getting%20files%20downloaded%20to%20that%20location.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20component%20names%20suggest%20Active%20Director%20authentication%20related%20bits.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-848876%22%20slang%3D%22en-US%22%3ERe%3A%20User%20tsninja%20-%20created%20on%20MacBook%20Pro%20after%20installing%20Teams%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-848876%22%20slang%3D%22en-US%22%3EI%20just%20discovered%20tsninja%20on%20my%20mac%20as%20well%20-%20as%20there%20been%20any%20update%20to%20this%20issue%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1036209%22%20slang%3D%22en-US%22%3ERe%3A%20User%20tsninja%20-%20created%20on%20MacBook%20Pro%20after%20installing%20Teams%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1036209%22%20slang%3D%22en-US%22%3E%3CP%3EFor%20clarity%2C%20especially%20when%20speaking%20with%20the%20engineering%20team%2C%20tsninja%20isn't%20a%20user%20account%2C%20it's%20simply%20a%20subdirectory%20created%20under%20%2FUsers%20(which%20*is*%20where%20one%20would%20expect%20account%20home%20directories%20to%20be%20created%2C%20thus%20the%20confusion).%20Uncertain%20why%20this%20wouldn't%20have%20been%20created%20under%20~%2FLibrary%2FApplication%20Support%2C%20consistent%20with%20other%20(Microsoft)%20applications%2C%20etc.%2C%20but%20there%20you%20are.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1229512%22%20slang%3D%22en-US%22%3ERe%3A%20User%20tsninja%20-%20created%20on%20MacBook%20Pro%20after%20installing%20Teams%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1229512%22%20slang%3D%22en-US%22%3E%3CP%3EI've%20noticed%20this%20as%20well%2C%20any%20updates%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Does MS Teams create a hidden user account on a mac called tsninja containing Azure framework files? I just discovered this account, deleted it and it was recreated when I relaunched Teams. I am running a local copy of Teams with one Team set up for which I am the admin.

 

I discovered this a couple of days ago and it looked like Malware.

Screenshot 2019-02-01 at 12.48.38.png

 

Further investigation showed this

 

Screenshot 2019-02-01 at 12.53.37.png

14 Replies
Highlighted

Hi @allygill 

 

Interesting question. I would assume so given that it reappeared after you reloaded the Teams Client. However, it would be good to get confirmation from Microsoft.

 

Can't find anything online or on the Tech Community. Personally I've never come across it before - but then again I use a Surface not a Mac.

 

@Jamie Starkcan you confirm this question? Does the Teams Client on Mac create the following user TSNinja?

 

Best, Chris

Highlighted
That name too :face_with_tears_of_joy:
Highlighted
Yes - that's what spooked me in the first place. It's clearly not a 'real' user because when I deleted it, it didn't put up a fight. No password requested - unusual for a user account.
Highlighted

Let me ask around.....

Highlighted

@Jamie Stark any news on the subject?

 

The Teams keeps crashing because it cannot create the user any more. Dtrace looks like this:

 

mkdir("/Users\0", 0x1ED, 0x0)                 = -1 Err#17
mkdir("/Users/tsninja\0", 0x1ED, 0x0)                 = -1 Err#13
mkdir("/Users/tsninja/vsts-agent\0", 0x1ED, 0x0)                 = -1 Err#2
mkdir("/Users/tsninja/vsts-agent/_work\0", 0x1ED, 0x0)                 = -1 Err#2
mkdir("/Users/tsninja/vsts-agent/_work/22\0", 0x1ED, 0x0)                 = -1 Err#2
mkdir("/Users/tsninja/vsts-agent/_work/22/s\0", 0x1ED, 0x0)                 = -1 Err#2
mkdir("/Users/tsninja/vsts-agent/_work/22/s/adal\0", 0x1ED, 0x0)                 = -1 Err#2
mkdir("/Users/tsninja/vsts-agent/_work/22/s/adal/mac\0", 0x1ED, 0x0)                 = -1 Err#2
mkdir("/Users/tsninja/vsts-agent/_work/22/s/adal/mac/output\0", 0x1ED, 0x0)                 = -1 Err#2
mkdir("/Users/tsninja/vsts-agent/_work/22/s/adal/mac/output/adalbuild\0", 0x1ED, 0x0)                 = -1 Err#2
mkdir("/Users/tsninja/vsts-agent/_work/22/s/adal/mac/output/adalbuild/Build\0", 0x1ED, 0x0)                 = -1 Err#2
mkdir("/Users/tsninja/vsts-agent/_work/22/s/adal/mac/output/adalbuild/Build/Intermediates.noindex\0", 0x1ED, 0x0)                 = -1 Err#2
mkdir("/Users/tsninja/vsts-agent/_work/22/s/adal/mac/output/adalbuild/Build/Intermediates.noindex/ADAL.build\0", 0x1ED, 0x0)                 = -1 Err#2
mkdir("/Users/tsninja/vsts-agent/_work/22/s/adal/mac/output/adalbuild/Build/Intermediates.noindex/ADAL.build/Release\0", 0x1ED, 0x0)                 = -1 Err#2
mkdir("/Users/tsninja/vsts-agent/_work/22/s/adal/mac/output/adalbuild/Build/Intermediates.noindex/ADAL.build/Release/ADAL Mac.build\0", 0x1ED, 0x0)                 = -1 Err#2
mkdir("/Users/tsninja/vsts-agent/_work/22/s/adal/mac/output/adalbuild/Build/Intermediates.noindex/ADAL.build/Release/ADAL Mac.build/Objects-normal\0", 0x1ED, 0x0)                 = -1 Err#2
mkdir("/Users/tsninja/vsts-agent/_work/22/s/adal/mac/output/adalbuild/Build/Intermediates.noindex/ADAL.build/Release/ADAL Mac.build/Objects-normal/x86_64\0", 0x1ED, 0x0)                 = -1 Err#2
open("/Users/tsninja/vsts-agent/_work/22/s/adal/mac/output/adalbuild/Build/Intermediates.noindex/ADAL.build/Release/ADAL Mac.build/Objects-normal/x86_64/ADAggregatedDispatcher.gcda\0", 0x202, 0x1A4)                 = -1 Err#2

 

Highlighted

I've been working with some of the engineers to try and get to the bottom of it, but no joy as yet. I have some more things they've asked me to try, and I will send them the results as soon as possible

Highlighted

Engineering is still looking into the issue.  This thread is noted in the work item and I'll ask that when resolved we follow up here.  

Highlighted

What are the other conditions to your issue? I'm a Mac User and I have been using Teams for months. That account has never been on my Mac. See screenshot below. Is your mac authentication to your AD? Does you Ad apply policies or profiles when setting up or logging into Office365?

 

Screen Shot 2019-03-08 at 9.16.38 AM.png

 

It looks like it is installing a vsts-agent on your mac to support Azure Pipelines to allow continuous updating of the client.  Do you have Office Insider turned on?

Highlighted

I too have a tsninja user created on my mac. I see there has been no updates to this thread. Can anyone dig into this and respond

 

Thanks


@allygill wrote:

Does MS Teams create a hidden user account on a mac called tsninja containing Azure framework files? I just discovered this account, deleted it and it was recreated when I relaunched Teams. I am running a local copy of Teams with one Team set up for which I am the admin.

 

I discovered this a couple of days ago and it looked like Malware.

Screenshot 2019-02-01 at 12.48.38.png

 

Further investigation showed this

 

Screenshot 2019-02-01 at 12.53.37.png


 

Highlighted

@allygill 

 

I've just noticed I've got a tsninja account created too!

Are there any updates from MS on why this is being created, if it is directly linked to Teams? 

Highlighted

My organization has been having trouble using teams; while we don't have tsninja accounts appearing on our devices if you launch Teams.app from Terminal you will get a multiple errors when it quits to the effect of:

 

profiling: /Users/tsninja/vsts-agent/_work/22/s/adal/mac/output/adalbuild/Build/Intermediates.noindex/ADAL.build/Release/ADAL Mac.build/Objects-normal/x86_64/*.gcda: cannot open: No such file or directory

 

Where * is the following:

ADAggregatedDispatcher , ADTokenCacheItem , ADNegotiateHandler , ADTelemetryHttpEvent , ADAuthenticationViewController , ADTelemetryAPIEvent , ADWebAuthController , ADAuthenticationContext , ADWebAuthResponse , ADAuthenticationRequest , ADUserIdentifier , ADTelemetry , ADTokenCacheItem+Internal , ADNTLMHandler , ADAuthenticationParameters+Internal , NSUUID+ADExtensions , ADAuthenticationError , ADTelemetryEventStrings , NSString+ADHelperMethods , ADJwtHelper , NSURL+ADExtensions , ADAuthenticationSettings , ADCredentialCollectionController , ADTokenCache , ADWorkPlaceJoinConstants , ADTelemetryCollectionRules , ADAuthenticationRequest+AcquireAssertion , ADLogger , ADClientMetrics , ADWorkPlaceJoinUtil , ADRegistrationInformation , ADAuthorityValidationRequest , ADTelemetryBrokerEvent , ADALFrameworkUtils , ADCustomHeaderHandler , ADTokenCacheKey , ADPkeyAuthHelper , ADBrokerHelper , ADTelemetryDefaultEvent , ADDefaultDispatcher , NSMutableDictionary+ADExtensions , ADURLProtocol , ADAuthenticationRequest+AcquireToken , ADAuthenticationParameters , NSDictionary+ADExtensions , ADNTLMUIPrompt , ADURLSessionDemux , ADAuthenticationResult+Internal , ADAcquireTokenSilentHandler , ADAuthenticationRequest+Broker , ADUserInformation , ADTokenCacheAccessor , ADClientCertAuthHandler , ADWebFingerRequest , ADTelemetryUIEvent , ADWebRequest , ADTelemetryCacheEvent , ADAuthorityValidation , ADDrsDiscoveryRequest , ADWebResponse , ADOAuth2Constants , ADRequestParameters , ADAuthenticationResult , ADIpAddressHelper , ADAuthenticationContext+Internal , ADWebAuthRequest , ADHelpers , ADAuthenticationRequest+WebRequest , ADAL_vers

 

My guess is this is some kind of debugging code. I'm tempted to create the folder heirarchy and see what happens, since it sounds like some of you are getting files downloaded to that location.

 

The component names suggest Active Director authentication related bits.

Highlighted
I just discovered tsninja on my mac as well - as there been any update to this issue?
Highlighted

For clarity, especially when speaking with the engineering team, tsninja isn't a user account, it's simply a subdirectory created under /Users (which *is* where one would expect account home directories to be created, thus the confusion). Uncertain why this wouldn't have been created under ~/Library/Application Support, consistent with other (Microsoft) applications, etc., but there you are.

Highlighted

I've noticed this as well, any updates? 

Related Conversations