Title
#macos
s

Steve Poe

01/12/2021, 12:03 AM
Can I use osquery (v4.6.0) to determine the keyboard type installed? If so, what would that query look like?
terracatta

terracatta

01/12/2021, 12:59 AM
Are you talking external keyboard or the built-in keyboard of the laptop? And by “type” do you mean layout? Or type of internal switching mechanism?
s

Steve Poe

01/12/2021, 2:04 AM
@terracatta The built-in keyboard. Yes, I want to identify the different layouts we're supporting (e.g. en, jp, uk, sk).
a

allister

01/12/2021, 2:07 AM
I looked this up in ioreg forever ago... let me find the code
2:10 AM
all I cared about was Japan because I couldn't get techs in EMEA to verify/QA/extend as needed... let me throw it in a gist
s

seph

01/12/2021, 2:13 AM
There's a luncher table wrapped over ioreg, but I'm not sure there's anything quite the same in osquery directly.
a

allister

01/12/2021, 2:15 AM
one of the practical concerns was sending a computer localized in the wrong OS and expecting people to log in when the keyboard input method didn't match. With current DEP and locally-sourced hdwe this should be LESS of a concern, since setup assistant should help vs. the old days when we were imaging
s

Steve Poe

01/12/2021, 2:19 AM
@allister ty. 🤔 I was hoping there was a way to pull the usb/bluetooth device info. In my world, we're supporting employees in Japan and EMEA with the variety of keyboard options. Sometimes when ordering a new laptop, we'll pull the info from Jamf which doesn't give the ability to show keyboard layout. Where Jamf could not provide the info, I'd create a EA using output from osquery.
a

allister

01/12/2021, 2:20 AM
definitely been there https://github.com/arubdesu/eas
s

Steve Poe

01/12/2021, 2:20 AM
ty 🙂
a

allister

01/12/2021, 2:21 AM
USB/bluetooth stuff can definitely be tricky, as a shortterm using the launcher @seph mentioned means you can look at HID's from system_profiler output
s

seph

01/12/2021, 2:57 AM
Launcher is kolides open source agent. It's runs osquery, adds custom tables, and manages updates. You can use it, or extract the tables.
s

Steve Poe

01/12/2021, 3:13 AM
@allister @seph I think I may have found something that could give me what I need with osquery:
select key,value from plist where path = '/Library/Preferences/com.apple.HIToolbox.plist' and value like '%keylayout%';
3:14 AM
With your input and seeing a jamf post, I thought I might be close. I could create an EA with this and related smart groups in Jamf.