Required: osquery must have Full Disk Access. Policy passes if all keys are encrypted, including if no keys are present.
Create or edit a configuration profile with the following information:
Create or edit the following script and configure it to run when the check fails:
Use the policy below to verify
SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM users CROSS JOIN user_ssh_keys USING (uid) WHERE encrypted='0');