How to Lock Down Windows Devices with Keyboard Filter Key Suppression

Start by enabling the Keyboard Filter Windows feature. This is the foundation that allows you to suppress key combinations.

Open PowerShell as Administrator and run:

Enable-WindowsOptionalFeature -Online -FeatureName KeyboardFilter -All -NoRestart

Alternatively, you can enable it through the GUI:

1. Search for "Turn Windows features on or off" in the Start menu
2. Expand "Device Lockdown"
3. Check "Keyboard Filter"
4. Click OK

Get-WindowsOptionalFeature -Online -FeatureName KeyboardFilter

The output should show State: Enabled.

The Keyboard Filter driver requires a system restart to load properly. This step is mandatory and cannot be skipped.

Restart-Computer -Force

After the restart, verify the keyboard filter driver is loaded by checking the registry:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318}\0000" -Name "UpperFilters"

Now configure which key combinations to block by creating registry entries. Navigate to the Keyboard Filter registry location:

# Create the main registry path if it doesn't exist
New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter" -Force

# Block Ctrl+Alt+Del
New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\v1" -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\v1" -Name "Name" -Value "Ctrl+Alt+Del"
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\v1" -Name "Flags" -Value 1 -Type DWord

# Block Alt+Tab
New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\v2" -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\v2" -Name "Name" -Value "Alt+Tab"
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\v2" -Name "Flags" -Value 1 -Type DWord

# Block Windows+L (Lock screen)
New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\v3" -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\v3" -Name "Name" -Value "Win+L"
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\v3" -Name "Flags" -Value 1 -Type DWord

Common key combinations to block for kiosk environments:

• Ctrl+Alt+Del - Security attention sequence
• Alt+Tab - Application switching
• Win+L - Lock screen
• Win+R - Run dialog
• Ctrl+Shift+Esc - Task Manager

Get-ChildItem -Path "HKLM:\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter"

After configuring the registry, restart the Keyboard Filter service to apply changes without a full system reboot:

Restart-Service -Name "Keyboard Filter" -Force

Test the blocked key combinations by attempting to use them:

1. Try pressing Ctrl+Alt+Del - it should be ignored
2. Try pressing Alt+Tab - no application switching should occur
3. Try pressing Win+L - the screen should not lock

For programmatic testing, you can check Windows Event Logs:

# Check for keyboard filter events
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-General'} -MaxEvents 10 | Where-Object {$_.Message -like "*keyboard*"}

Get-Service -Name "Keyboard Filter"

For deploying to multiple devices, create a provisioning package using Windows Configuration Designer. First, install it from the Microsoft Store if not already available.

Launch Windows Configuration Designer and create a new project:

1. Select "Advanced provisioning"
2. Name your project (e.g., "KioskKeyboardFilter")
3. Navigate to Runtime settings > SMISettings > KeyboardFilter

Configure the following settings:

<!-- Key settings to configure -->
AllowWindowsLogon = False
BlockNonAdminKeys = True
EnableKeyboardFilter = True

For custom key combinations, export your registry settings and import them:

# Export your keyboard filter registry
reg export "HKLM\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter" C:\temp\keyboardfilter.reg

Import this .reg file into the Windows Configuration Designer under Runtime settings > RegistrySettings.

Build the provisioning package:

1. Click "Export" > "Provisioning package"
2. Choose security settings (recommend password protection)
3. Build the .ppkg file

For enterprise deployment, use Microsoft Intune to push keyboard filter configurations to managed devices. Access the Microsoft Intune admin center and create a new configuration profile.

Navigate to Devices > Configuration profiles > Create profile:

1. Platform: Windows 10 and later
2. Profile type: Settings catalog
3. Name: "Kiosk Keyboard Filter Policy"

Add keyboard filter settings:

{
  "KeyboardFilter": {
    "AllowAdminKeys": false,
    "BlockedKeys": [
      "Ctrl+Alt+Del",
      "Alt+Tab",
      "Win+L",
      "Win+R",
      "Ctrl+Shift+Esc"
    ]
  }
}

Assign the policy to your target groups:

1. Click "Assignments"
2. Select "Add groups"
3. Choose your kiosk or shared device groups
4. Set deployment schedule if needed

Monitor deployment status:

# On target devices, check Intune sync status
dsregcmd /status

# Force immediate sync
Get-ScheduledTask | Where-Object {$_.TaskName -eq "PushLaunch"} | Start-ScheduledTask

Fine-tune your keyboard filter with advanced options for specific use cases. Configure additional registry settings for enhanced control:

# Allow specific admin bypass keys
New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\Settings" -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\Settings" -Name "AllowAdminKeys" -Value 0 -Type DWord

# Block function keys (F1-F12)
for ($i=1; $i -le 12; $i++) {
    $keyPath = "HKLM:\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\v$($i+10)"
    New-Item -Path $keyPath -Force
    Set-ItemProperty -Path $keyPath -Name "Name" -Value "F$i"
    Set-ItemProperty -Path $keyPath -Name "Flags" -Value 1 -Type DWord
}

# Block Windows key combinations
$winKeys = @("Win+D", "Win+E", "Win+I", "Win+M", "Win+P", "Win+S", "Win+X")
$counter = 20
foreach ($key in $winKeys) {
    $keyPath = "HKLM:\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\v$counter"
    New-Item -Path $keyPath -Force
    Set-ItemProperty -Path $keyPath -Name "Name" -Value $key
    Set-ItemProperty -Path $keyPath -Name "Flags" -Value 1 -Type DWord
    $counter++
}

Configure special handling for on-screen keyboard and touch inputs:

# Ensure on-screen keyboard is also filtered (supported since Windows 10 1809)
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\Settings" -Name "FilterOnScreenKeyboard" -Value 1 -Type DWord

Address common problems that occur with Keyboard Filter deployments. Start by checking the service status and driver loading:

# Check if Keyboard Filter service is running
Get-Service -Name "Keyboard Filter" | Format-List

# Verify driver is loaded in the keyboard stack
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318}\0000" -Name "UpperFilters"

Common issues and solutions:

Force reload the keyboard filter driver:

# Stop and restart the keyboard filter service
Stop-Service -Name "Keyboard Filter" -Force
Start-Service -Name "Keyboard Filter"

# Alternative: Restart the entire keyboard subsystem
pnputil /restart-device "HID\VID_*"

Check Windows Event Logs for detailed error information:

# Look for keyboard filter related errors
Get-WinEvent -FilterHashtable @{LogName='System'; Level=2,3} | Where-Object {$_.ProviderName -like "*keyboard*" -or $_.Message -like "*filter*"}