Does the 'Keyboard Filter' Windows Feature not work in Windows 11 IoT?

Question

Does the 'Keyboard Filter' Windows Feature not work in Windows 11 IoT?

Ryan Harrison 5

I have a Windows 10 IoT LTSC 2029 Image that has supported Keyboard Filters for a long time. Specific use case is blocking some key combinations (Alt+F4, Ctrl+Alt+Del) on PCs running enterprise software. Windows 10 works as it should.

In created a very similar image based on Windows 11 IoT (22H2), the same Keyboard Filters are just not working at all.

All desired keys to block are set as "Blocked" at "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter".
Microsoft Keyboard Filter service is running and starts automatically.
DisableKeyboardFilterForAdministrators is set to false (0) but I have also tried with set to true (1) with no success.
I queried 'Windows Features' via powershell and 'Client-Keyboard Filter' is Enabled.

I need suggestions on what else to look at. There isn't any reason these blocked key combinations should be working like they are.

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

5 answers

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

David Venegoni 0

Encountered a similar issue where the keyboard filter wouldn't work if the system was started up with no physical keyboard attached and the touch keyboard was used. Changing the startmode of the keyboard filter driver from manual to auto resolved this issue for me:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbldfltr]

"Start"=dword:00000002

0 comments

Answer 2

Windows 11 IoT (22H2)? Do you mean Windows 11 IoT (24H2)? I have not run into issues with Keyboard filter.

How are you enabling the keyboard filter feature and how are you setting the keyboard filter rules? Are you using SIM?
Are you creating a clean Windows image? Have you run Windows updates?
Please check me Keyboard filter utility to verify the rules are being set: https://annabooks.com/SW_KBFUtility.html
Is the keyboard that you are trying to block on on-screen keyboard or a real hardware keyboard?

Answer 3

Hi Ryan Harrison,,

I'm checking back to see if verifying the driver bindings resolved the 2147500036 error on your Windows IoT image. As previously discussed, this specific error indicates the kbdfllt driver is failing to attach to the kernel stack; the solution relies on ensuring kbdfllt is explicitly listed in the UpperFilters registry value at {4d36e96b-e325-11ce-bfc1-08002be10318}, disabling Fast Startup via powercfg /h off to force correct driver initialization, and disabling the TextInputManagementService which frequently overrides filter drivers in the 24H2 environment.

If the issue has been successfully resolved, please consider accepting the answer as it helps other people sharing the same question benefit too. Thank you!

VP

Answer 4

VPHAN 42,425 Independent Advisor

Hello Ryan Harrison,

I am following up to ensure the Keyboard Filter functionality has been successfully restored on your Windows 11 IoT Enterprise 22H2 image. As detailed previously, this failure typically stems from a disconnect between the static registry keys and the active WMI provider, or interference from the Modern Input Stack. Verifying the active rules via Get-CimInstance -Namespace root\standardcimv2\embedded and disabling the TabletInputService to prevent the bypass of kbdfllt.sys are the critical steps to force the filter to engage.

If the issue has been successfully resolved, please consider accepting the answer as it helps other people sharing the same question benefit too. Thank you!

VP

Ryan Harrison 5 Reputation points

2026-01-09T18:24:42.3233333+00:00

Hi VP,

Thanks for following up. I've been working on this today an unfortunately none of these worked.

When running Get-CimInstance -Namespace root\standardcimv2\embedded -ClassName WEKF_PredefinedKey, I see my registry keys and they are set appropriately.

"Touch Keyboard and Handwriting Panel Service" is not a service that is running on my image.

And I just finished reviewing the Event logs here: "Applications and Services Logs"\Microsoft\Windows\KeyboardFilter". I don't have the error code you mentioned but I do see 'Set KeyboardLayout failed. Operation aborted' (error code 2147500036)
Ryan Harrison 5 Reputation points

2026-01-09T18:25:46.94+00:00

I've also upgraded the image to 24H2 and the issue persists.
VPHAN 42,425 Reputation points Independent Advisor

2026-01-09T18:40:39.3466667+00:00

The specific error code 2147500036 (Operation Aborted) in the Set KeyboardLayout event is the diagnostic key here. It indicates that while the user-mode management service (wekfsvc) is running and reading your WMI configuration correctly, it is failing to communicate that configuration to the kernel-mode driver because the driver hook is either detached or loading in the wrong order. This is common after upgrading Windows versions (like moving to 24H2), as the OS upgrade process frequently resets the device class filters, effectively leaving the Keyboard Filter installed but disconnected from the physical hardware stack.

You need to manually verify and repair the driver bindings in the registry. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318}. This is the GUID for the Keyboard class. Locate the UpperFilters Multi-String value. In a functional Keyboard Filter environment, this list must include kbdfllt. If you only see kbdclass (or other third-party filters), the WEKF driver isn't being loaded by the kernel. Add kbdfllt to this list (ensure it's on a separate line from kbdclass), restart the device, and the service should successfully lock the layout.

If kbdfllt is already present, the "Operation Aborted" error suggests a conflict with Windows Fast Startup (Hiberboot), which caches kernel drivers and bypasses the initialization routine that WEKF relies on to map scancodes to the current layout. Open an elevated command prompt and run powercfg /h off to force a full kernel initialization on the next boot. Additionally, since you are on 24H2 and noted the "Touch Keyboard" service was missing, be aware that it has likely been superseded by the "Text Input Management Service" (TextInputManagementService). You should ensure this specific service is stopped and disabled, as it aggressively hooks input in the 24H2 build, overriding legacy filters.

VP

Answer 5

Hello Ryan Harrison,

You should first verify what the system actually recognizes as an active rule by running the PowerShell command Get-CimInstance -Namespace root\standardcimv2\embedded -ClassName WEKF_PredefinedKey. If this command returns no output despite your registry keys being present, you must re-instantiate the rules using the WMI commands (e.g., the Enable-WEKF_PredefinedKey function or direct CIM modification) to force the driver to pick up the configuration. If the rules do appear in the WMI output, the issue is likely the Windows 11 Modern Input stack bypassing the legacy filter driver; you can test this by disabling the "Touch Keyboard and Handwriting Panel Service" (TabletInputService) in services.msc and restarting, as this service frequently intercepts input commands before they reach the Keyboard Filter in the 22H2 release. Finally, check the Microsoft-Windows-KeyboardFilter/Admin channel in Event Viewer for specific failure codes like 0x80070057, which would indicate an invalid scancode definition in your migrated configuration.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

VP