Keyboard Filter (Industry 8.1)

Article
12/14/2016

7/8/2014

Learn how to enable, disable, and configure Keyboard Filter on your Windows Embedded 8.1 Industry (Industry 8.1) device.

You can use Keyboard Filter in Industry 8.1 to suppress undesirable key presses or key combinations. Normally, a customer can use certain Windows key combinations like Ctrl+Alt+Delete or Ctrl+Shift+Tab to alter the operation of a device by locking the screen or using Task Manager to close a running application. This may not be desirable if your device is intended for a dedicated purpose. However, you can use Keyboard Filter to suppress any key press or key combination that causes an undesirable system behavior.

Keyboard Filter works with physical keyboards, the Windows On-Screen Keyboard, and the touch keyboard. Keyboard Filter also detects dynamic layout changes, such as switching from one language set to another, and continues to suppress keys correctly, even if the location of suppressed keys has changed on the keyboard layout.

Keyboard Filter features

In Industry 8.1, Keyboard Filter has the following features:

Supports hardware keyboards, the standard Windows On-Screen Keyboard (OSK), and the touch keyboard (TabTip.exe).
Suppresses key combinations even when they come from multiple keyboards.
For example, if a user presses the Ctrl key and the Alt key on a hardware keyboard, while at the same time pressing Delete on a software keyboard, Keyboard Filter can still detect and suppress the Ctrl+Alt+Delete functionality.
Supports numeric keypads and keys designed to access media player and browser functionality.
Can configure a key to breakout of a locked down user session to return to the Welcome screen.
Automatically handles dynamic layout changes.
Can be enabled or disabled for administrator accounts.
Can force disabling of Ease of Access functionality.
Can block physical hardware keys.
Supports x86 and x64 architectures.

Turn Keyboard Filter on or off

By default, Keyboard Filter is not turned on. You can turn Keyboard Filter on or off for your Industry 8.1 device by using the following steps:

To turn Keyboard Filter on or off by using Control Panel

In Control Panel, click Programs and Features.
In the Programs and Features window, click Turn Windows features on or off.
In the Windows Features window, expand the Embedded Features node, and check or clear the checkbox for Keyboard Filter.

To turn Keyboard Filter on or off by using DISM

Open a command prompt with administrator rights.
At the command prompt, type the following command to turn on Keyboard Filter:
```
Dism /online /Enable-Feature /FeatureName:ISKU-KeyboardFilter
```
-or-

Type the following command to turn off Keyboard Filter:
```
Dism /online /Disable-Feature /FeatureName:ISKU-KeyboardFilter
```

Turning on Keyboard Filter requires that you restart your device. Keyboard Filter is automatically enabled after the restart.

Keyboard scan codes and layouts

When a key is pressed on a physical keyboard, the keyboard sends a scan code to the keyboard driver. The driver then sends the scan code to the OS and the OS converts the scan code into a virtual key based on the current active layout. The layout defines the mapping of keys on the physical keyboard, and has many variants. A key on a keyboard always sends the same scan code when pressed, however this scan code can map to different virtual keys for different layouts. For example, in the English (United States) keyboard layout, the key to the right of the P key maps to “{“. However, in the Swedish (Sweden) keyboard layout, the same key maps to “Å”.

Keyboard Filter can block keys either by the scan code or the virtual key. Blocking keys by the scan code is useful for custom keyboards that have special scan codes that do not translate into any single virtual key. Blocking keys by the virtual key is generally more convenient because it is easier to read and Keyboard Filter suppresses the key correctly even when the location of the key changes because of a layout change.

When you configure Keyboard Filter to block keys by using the virtual key, you must use the English names for the virtual keys. For more information about the names of the virtual keys, see Keyboard Filter key names.

For the Windows On-Screen Keyboard (OSK), Keyboard Filter converts each keystroke into a scan code based on the layout, and back into a virtual key. This allows Keyboard Filter to suppress OSK keys in the same manner as physical keyboard keys, whether they are configured by scan code or virtual key.

Keyboard Filter and Ease of Access features

By default, Ease of Access features are enabled and Keyboard Filter is disabled for administrator accounts.

If Sticky Keys are enabled, a user can bypass Keyboard Filter in certain situations. You can configure Keyboard Filter to disable all Ease of Access features and prevent users from enabling them.

You can enable Ease of Access features for administrator accounts, while still disabling them for standard user accounts, by making sure that Keyboard Filter is disabled for administrator accounts.

Keyboard Filter configuration

You can configure the following options for Keyboard Filter:

Set/unset predefined key combinations to be suppressed.
Add/remove custom defined key combinations to be suppressed.
Enable/disable Keyboard Filter for administrator accounts.
Force disabling Ease of Access features.
Configure a breakout key sequence to break out of a locked down account.

Most configuration changes take effect immediately. Some changes, such as enabling or disabling Keyboard Filter for administrators, do not take effect until the user signs out of the account and then back in. If you change the breakout key scan code, you must restart the device before the change take effect.

You can configure Keyboard Filter by using Windows Management Instrumentation (WMI) providers. You can use the Keyboard Filter WMI providers directly in a Windows PowerShell script or in an application. You can also use Embedded Lockdown Manager (ELM) to configure Keyboard Filter. ELM can generate Windows PowerShell scripts that use the WMI providers.

For more information about Keyboard Filter WMI providers, see Keyboard Filter WMI provider reference.

For more information about ELM, see Embedded Lockdown Manager.

Keyboard breakout

You may need to sign in to a locked down device with a different account in order to service or configure the device. In Industry 8.1, you can configure a breakout key to break out of a locked down account by specifying a key scan code. When you quickly press the breakout key five times in a row, Industry 8.1 presents the Welcome screen so that you can sign in to a different account.

The breakout key is set to the scan code for the left Windows logo key by default. You can use the WEKF_Settings WMI class to change the breakout key scan code. If you change the breakout key scan code, you must restart the device before the change takes effect.

Keyboard Filter event logging

Keyboard Filter uses Event Tracing for Windows (ETW) to log events and errors. For more information, see Keyboard Filter events.

Keyboard Filter considerations

Starting a device in Safe Mode bypasses Keyboard Filter. The Keyboard Filter service is not loaded in Safe Mode, and keys are not blocked in Safe Mode.

Keyboard Filter cannot block the Sleep key.

Some hardware keys, such as rotation lock, do not have a defined virtual key. You can still block these keys by using the scan code of the key.

The add (+), multiply (*), subtract (-), divide (/), and decimal (.) keys have different virtual keys and scan codes on the numeric keypad than on the main keyboard. You must block both keys to block these keys. For example, to block the multiply key, you must add a rule to block “*” as well as a rule to block Multiply.

When locking the screen by using OSK, or a combination of a physical keyboard and OSK, OSK sends an additional Windows logo key keystroke to the OS. If your device is using the Windows 8 shell and you use Keyboard Filter to block Windows logo key+L, the extra Windows logo key keystroke causes the shell to switch between the Start screen and the last active app when a user attempts to lock the device by using OSK, which may be unexpected behavior.

Some custom keyboard software, such as Microsoft IntelliType Pro, can install keyboard filter drivers that prevent Keyboard Filter from being able to block some or all keys, typically extended keys like BrowserHome and Search.