Export (0) Print
Expand All

Keyboard Filter (Industry 8)


Learn how to configure Keyboard Filter on your Windows Embedded 8 Industry (Industry 8) device.

You can use Keyboard Filter in Windows Embedded 8 Industry (Industry 8) to suppress undesirable keystrokes or key combinations. Normally, a customer can use certain Windows key combinations like Ctrl+Alt+Delete or Ctrl+Shift+Tab to alter the operation of a device by locking the screen or using Task Manager to close a running application. This may not be desirable if your device is intended for a dedicated purpose. However, you can use Keyboard Filter to suppress any keystroke or key combination that causes an undesirable system behavior.

Keyboard Filter has been redesigned for Industry 8, and works with physical keyboards, touch keyboards, and the standard Windows On-Screen Keyboard. Keyboard Filter also detects dynamic layout changes, such as switching from one language set to another, and continues to suppress keys correctly, even if the location of suppressed keys has changed on the keyboard layout.

In Industry 8, Keyboard Filter has the following features:

  • Supports hardware keyboards, the standard Windows On-Screen Keyboard (OSK), and the Windows 8 app style touch keyboard (TabTip.exe).
  • Suppresses key combinations even when they come from multiple keyboards.
    For example, if a user presses the Ctrl key and the Alt key on a hardware keyboard, while at the same time pressing Delete on a software keyboard, Keyboard Filter can still detect and suppress the Ctrl+Alt+Delete functionality.
  • Supports numeric keypads and keys designed to access media player and browser functionality.
  • Automatically handles dynamic layout changes.
  • Can be enabled or disabled for administrator accounts.
  • Can force disabling of Ease of Access functionality.
  • Supports x86 and x64 architectures.

When a key is pressed on a physical keyboard, the keyboard sends a scan code to the keyboard driver. The driver then sends the scan code to the OS and the OS converts the scan code into a virtual key based on the current active layout. The layout defines the mapping of keys on the physical keyboard, and has many variants. A key on a keyboard always sends the same scan code when pressed, however this scan code can map to different virtual keys for different layouts. For example, in the English (United States) keyboard layout, the key to the right of the P key maps to “{“. However, in the Swedish (Sweden) keyboard layout, the same key maps to “Å”.

Keyboard Filter can block keys either by the scan code or the virtual key. Blocking keys by the scan code is useful for custom keyboards that have special scan codes that do not translate into any single virtual key. Blocking keys by the virtual key is generally more convenient because it is easier to read and Keyboard Filter suppresses the key correctly even when the location of the key changes because of a layout change.

When you configure Keyboard Filter to block keys by using the virtual key, you must use the English names for the virtual keys. See Keyboard Filter Key Names for more information about the names of virtual keys.

For the Windows on-screen keyboard (OSK), Keyboard Filter converts each key press into a scan code based on the layout, and back into a virtual key. This allows Keyboard Filter to suppress OSK keys in the same manner as physical keyboard keys, whether they are configured by scan code or virtual key.

If Sticky Keys are enabled, a user can bypass Keyboard Filter in certain situations. You can configure Keyboard Filter to disable all Ease of Access features and prevent users from enabling them.

You can enable Ease of Access features for administrator accounts by disabling Keyboard Filter for administrator accounts.

Keyboard Filter uses Event Tracing for Windows (ETW) to log events and errors. See Keyboard Filter Events for more information.

Starting a device in safe mode bypasses Keyboard Filter. The Keyboard Filter service is not loaded in safe mode, and keys are not blocked in safe mode.

Keyboard Filter cannot block the Sleep key.

The addition (+), multiplication (*), subtraction (-), division (/), and decimal (.) characters have different virtual keys and scan codes on the numeric keypad than on the main keyboard. You must block both keys to block these keys. For example, to block the multiplication character, you must add a rule to block “*” in addition to a rule to block Multiply.

When locking the screen by using OSK, or a combination of a physical keyboard and OSK, OSK sends an additional Windows logo key keystroke to the OS. If your device is using the Windows 8 shell and you use Keyboard Filter to block Windows logo key+L, the extra Windows logo key keystroke causes the shell to switch between the Start screen and the last active app when a user attempts to lock the device by using OSK, which may be unexpected behavior.

Some custom keyboard software, such as Microsoft IntelliType Pro, can install keyboard filter drivers that prevent Keyboard Filter from being able to block some or all keys, typically extended keys like BrowserHome and Search.

If Keyboard Filter is enabled during Industry 8 Setup, the following default behaviors are enabled.

Accounts Affected

By default, all accounts other than the administrator accounts are subject to keyboard filtering.

Key Press and Combinations Affected

By default, the keystrokes and key combinations in the following tables are suppressed.

Application Keys

Key combination



Close application


Close window

Windows logo key+F1

System Help

Shell Keys

Key combination



Shortcut menu for active window


Start menu

Ctrl+Windows logo key+F

Search for computers

Windows logo key+Break

System properties

Windows logo key+E

Windows Explorer

Windows logo key+F


Windows logo key+P, Windows logo key+Shift+P

Cycle through Presentation Mode

Windows logo key+Ctrl+R

Run dialog

Alt+Tab, Alt+Shift+Tab

Switch tasks


Switch windows

Windows logo key+Tab

Cycle through Windows 8 apps. Also blocks the Windows logo key+Ctrl+Tab and Windows logo key+Shift+Tab key combinations.

Windows logo key+D

Show desktop

Windows logo key+M

Minimize all windows

Windows logo key+Home

Minimize/restore all non-active windows

Windows logo key+T

Set focus on taskbar and cycle through programs

Windows logo key+B

Set focus in the notification area

Windows logo key+Minus Sign

Magnifier zoom out

Windows logo key+Plus Sign

Magnifier zoom in

Windows logo key+Esc

Close Magnifier application

Windows logo key+Page Up

Minimize window

Windows logo key+Page Down

Maximize window

Windows logo key+Left Arrow

Move window to the left half of screen

Windows logo key+Right Arrow

Move window to the right half of screen

Windows logo key+Shift+Page Up

Vertically maximize window

Windows logo key+Shift+Page Down

Restore window

Windows logo key+Shift+Left Arrow

Move window to left monitor

Windows logo key+Shift+Right Arrow

Move window to right monitor

Windows logo key+Spacebar

Switch layout

Windows logo key+O

Lock device orientation

Windows logo key+Enter

Start narrator

Windows logo key+Page Up

Move Windows 8 shell to left monitor

Windows logo key+Page Down

Move Windows 8 shell to right monitor

Windows logo key+Period

Move Windows 8 shell gutter to the left or right. Also blocks Windows logo key+Shift+Period.

Windows logo key+C

Open charms

Windows logo key+I

Open Settings charm

Windows logo key+K

Open Connect charm

Windows logo key+H

Open Share charm

Windows logo key+Q

Open Search charm

Windows logo key+W

Open Settings Search charm

Windows logo key+Z

Open app bar

Windows logo key+/

Open input method editor (IME)

Windows logo key+J

Swap between snapped and filled applications

Windows logo key+Comma

Desktop Peek

Windows logo key+V

Cycle through toasts in reverse order

Security Keys

Key combination



Windows Security screen


Task Manager

Windows logo key+L

Lock console

Extended Shell Keys

Key combination



Start Mail key


Select Media key


Start Application 1 key


Start Application 2 key


Volume Mute key


Volume Down key


Volume Up key


Next Track key


Previous Track key


Stop Media key


Play/Pause Media key

All configuration settings for Keyboard Filter are stored in the registry, and configuration changes take effect immediately. You can configure the following options:

  • Set/unset predefined key combinations to be suppressed.
  • Add/remove custom defined key combinations to be suppressed.
  • Enable/disable Keyboard Filter for administrator accounts.
  • Force disabling Ease of Access features.

Audit Mode Configuration

The configuration for Keyboard Filter is saved to the PowerShell script %windir%\Panther\Unattend\ConfigureKeyboardFilter.ps1 and is applied after the first logon after OOBE. If you want to change the default behavior of Keyboard Filter, you can enable audit mode and modify this PowerShell script in audit mode before starting in OOBE.

Run-Time Configuration

Configure Keyboard Filter at run time by using Windows Management Instrumentation (WMI) providers. You can use the Keyboard Filter WMI providers directly in a PowerShell script or in an application. You can also use Embedded Lockdown Manager (ELM) to configure Keyboard Filter. The ELM can generate PowerShell scripts that use the WMI providers.

Industry 8 does not support using Group Policy to configure Keyboard Filter.

See Keyboard Filter WMI Provider Reference for more information about Keyboard Filter WMI providers.

See Embedded Lockdown Manager (ELM) Technical Reference for more information about ELM.

© 2014 Microsoft