Loading...

Block or unblock keyboard combinations on your devices with PowerShell

Reply A+ A-


In this post I will show you how to prevent some keyboard combinations on your devices with PowerShell.

Context
See below what do we want:
- Forbid some keyboard shortcut to be executed
- For instance block Windows+R

The solution
The solution is pretty easy and not something really new.
Actually in Windows you can find a cool feature called Keyoard filter allowing you to block some keyboard shortcut.
To enable it proceed as below:
1. Go to Turn Windows features on or off
2. Go to Device lockdown
3. Check Keyboard filter
4. Click on OK
5. Reboot your computer

How does it work ?
The feature works with WMI.
Different classes exists:
- WEKF_PredefinedKey
- WEKF_CustomKey
- WEKF_Scancode 
- WEKF_Settings 

See below what they do:
- WEKF_CustomKey: Blocks/unblocks custom key combinations
- WEKF_PredefinedKey: Blocks/unblocks predefined key combinations
- WEKF_Scancode: Blocks/unblocks key combinations using scan codes
- WEKF_Settings: Enables/disables settings for Keyboard Filter

More informations
See more informations about the WMI provider here
See more informations about the CustomKey class here
See more informations about the PredefinedKey class here.
See here a link of predefined keys that can be used. 

On MS link you can find a script that can be used to block keyboard combination.

Using WMI provider
In this part we will play with both WEKF_PredefinedKey and WEKF_CustomKey classes.

List existing combinations
The PredefinedKey class allows you to list existing combinations that you can block. 
For that just use the below command:
This will give the result below:

As you may noticed by default, the keyboard combination is located in the id property and status in enabled.
This means to enable a keyboard combination we will use both id and enabled properties.

The WEKF_CustomKey class does not give the possibility to list existing combinations but only applied combinations.

List applied combinations
In this part we will list keyboard combinations that are currently blocked by the keyboard filter for both CustomKey and PredefinedKey.
We will use the same previous command.
To list applied PredefinedKey keyboard combinations use the below command:
To list applied CustomKey keyboard combinations use the below command:
As you may noticed CustomKey list is empty because we haven't enabled or disabled keyoard combinations.
We will do it and list again in the next part.

You can also list combinations from the registry into HKLM\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter
The KeyboardFilter contains Predefined Keys.


To find custom keys go to the CustomFilters key.


Block keyboard combination
In this part we will block some PredefinedKey and CustomKey keyboard combinations using the WMI provider.
We will try to block the Ctrl Alt Del combination.

We will first list status for this combination as below:
The result for CustomKey is empty, meaning there is not combination setted for this.
The result for PredefinedKey is the following one, meaning not blocked.


Using WEKF_PredefinedKey
To block a keyboard combination we will change the status of the enabled property to True then apply the Put method to apply combination.
See below the command:

Using WEKF_CustomKey
Blocking a combination using WEKF_CustomKey is a bit different.
If the combination does not exist yet you have to use another way.
We will block Ctrl Alt Del.
See below the code for that:
If the combination  already exists we will use the same way that with WEKF_PredefinedKey.
In the below example we will unblock Ctrl Alt Del:

List and block again
Now let's list again applied combinations:
See below result for WEKF_PredefinedKey:

See below result for WEKF_CustomKey:

Now if you want to block for instance the possiblity to open the run panel, let's first give a look to the PredefinedKey list if we can find it.
We will search for settings with Win+R value, as below:
See below the result:

Tadaaa we have Win+R there, meaning we can use the WEKF_PredefinedKey class to block this combination.
See below the command to block the combination:

Unblock keyboard combinations
In this part we will unblock our previous applied  PredefinedKey and CustomKey keyboard combinations using the WMI provider.
To unblock a keyboard combination we will change the status of the enabled property to False then apply the Put method to apply combination.
See below the command to unblock combination Ctrl Alt Del:
See below the command to unblock combination Win+R:

Remove a combination
This will work only for CustomKey.
To remove a combination that you have added, proceed as below:
1. Initialize the WMI class
2. Remove a specific id

Script all in one
I created a script allowing you to list, block, unblock or remove WEKF_CustomKey and WEKF_PredefinedKey combinations.
Click on the below picture to get the script:


Script in action
The function is called Set_WEKF and contains below parameters:
- Key_ID: Keyboard combination 
- Action: Block or Unblock
- List: List all applied combinations
- Remove: Switch to remove a custom key

See below how to use the function Set_WEKF.

Block a combination:
Unblock a combination:
List applied combinations:
Remove a WEKF_CustomKey

In the below example, we will manage below combinations as following:
- Block Ctrl Alt Del with WEKF_PredefinedKey
- Unblock Ctrl Alt Del with WEKF_PredefinedKey
- Block Win+R with with WEKF_PredefinedKey
- Block Windows+A with WEKF_CustomKey
- Remove WEKF_CustomKey Windows+A
- List applied combinations

What does the script ?
When you try to block or unblock a combination, the script will first check in the WEKF_PredefinedKey class, if the combination exists.
- If yes, it will use this class.
- If not, the class WEKF_CustomKey will be used.
Powershell 2333923352637129119

Enregistrer un commentaire

Accueil item

Award

Learn KQL in one month

Sponsors

You want to support me ?

Mes articles en français

Books in French


Stats