none
Keyboard Filter on WES7 SP1? RRS feed

  • Question

  • So it's not included inside yet, right? Previously on another thread, I read that it be included with SP1. Right now I'm sorely wanting this because it's the easiest way out than the elba one which I need to find out exactly what are the keycodes, not to mention that I have to worry about different keyboards?

     

    Thanks.

    Thursday, July 28, 2011 11:19 AM

All replies

  • i asked for it recently in the blog: still no answer...
    "Mark/Propose As Answer" if you got one.
    Thursday, July 28, 2011 12:46 PM
  • i asked for it recently in the blog: still no answer...
    "Mark/Propose As Answer" if you got one.
    Doubt we can get an answer here? :(
    Friday, July 29, 2011 2:08 AM
  • Hi.

    It's available now.

    Sanghyun

     

     

    Monday, October 3, 2011 4:21 AM
  • not completly official.

    and i wrote a small tutorial month ago how to get the filter.


    "Mark/Propose As Answer" if you got one.
    Tuesday, October 4, 2011 4:27 AM
  • Does anyone know if the filter can be applied on a port-by-port basis?  For example, can I filter keyboard input on one USB port but not another?

    Thanks!

    Thursday, October 13, 2011 11:48 PM
  • you can white and blacklist pid/vids or classes within the group policies. (admin template-driver installation)
    "Mark/Propose As Answer" if you got one.
    Friday, October 14, 2011 1:14 PM
  • They finaly got it.

    http://blogs.msdn.com/b/embedded/archive/2011/10/11/new-feature-updates-for-winows-embedded-standard-7-are-now-on-ece.aspx

    And it's little different from the PoS cab.
    Windows Embedded Developer and Scripting Guy //Germany
    Monday, October 17, 2011 11:33 PM
  • Does anyone know if the filter can be applied on a port-by-port basis?  For example, can I filter keyboard input on one USB port but not another?

    Thanks!


    Hi beemr007,

    No, filtering cannot be per keyboard device, however I'd like to hear what problem you're trying to solve.

    The reason filtering is global is because per keyboard filtering can be insecure, at least for blocking Ctrl+Alt+Del.  If an attacker plugs in two keyboards beyond what's already there, he (or she) can press Ctrl on one, Alt on another, and Del on the third.  Windows will understand this and show the secure desktop.  The keyboard filter however is designed to see these attempts and block them.

    There's no easy way to filter keys from each keyboard independently.  The only way I know of is a filter driver.  There's a good example in the DDK, but it requires that an INF is manually installed when the keyboard hardware is attached or it won't work.

    Brendan

    Wednesday, October 19, 2011 6:04 PM
  • @ beemr007

    In KBF you have the ability to exclude Administators. - This may help your issue.
    Windows Embedded Developer and Scripting Guy //Germany
    Wednesday, October 19, 2011 6:32 PM
  • hi,

    can someone explains how the ICE Embedded Enabling Features/Keyboard Filter works?

    Still now help content in my ICE.I have to block alt+strg+del.

     

    Thanks

    Friday, November 4, 2011 7:50 AM
  • gpedit.msc

    there is a entry at administrator template with "Keyboard Filter"


    Windows Embedded Developer and Scripting Guy //Germany
    Friday, November 4, 2011 1:23 PM
  • To add to this, the keyboard filter didn't offer any configuration available to ICE, so it installs allowing everything.

    There are two options.  As Knarz says to load group policy editor and set it.  If you are using SysPrep and mass deploying the output, this should be easy enough.

    If you're installing only through unattends, another option is to create a custom action in ICE that pushes a group policy manually into the Registry (look under HKLM\Software\Policies\Microsoft\KeyboardFilter, get the keys and names from a test machine) and running GPUpdate /Force.  Now, I've never tried that, so I can't say it will work, but it should.

    Also, about Group Policy, the Registry is just a way to publish policies, not set or store them (they are stored in a binary file, Registry keys are frequently torn down and rebuilt from that data file).  GPUpdate is a back door to this that is often used to do this.  

    I'm also not an expert on ICE, so I can't help on how to create custom actions. If you're using keyboard filter, it might be a good time to set other lockdown related policies.  If you need help to do this, see the Tools or Deployment Forums, they might offer more help. 

    Friday, November 4, 2011 6:02 PM
  • I tried to download the Keyboard Filter features from the following link:

    http://blogs.msdn.com/b/embedded/archive/2011/10/11/new-feature-updates-for-winows-embedded-standard-7-are-now-on-ece.aspx

    I always get "You are not authorized to view this page" error. 

    From http://msdn.microsoft.com/en-us/library/hh505826(v=winembedded.60).aspx , I tried to get to gpedit.msc. I could not find the Computer Configuration, Administrative Templates, System, Keyboard Filter entry from Computer Configuration, Administrative Templates, System.

    My question is: how can I get to Keyboard Filter?

    Thanks.

    Tuesday, November 15, 2011 5:06 AM
  • Tuesday, November 15, 2011 5:10 AM
  • After downloading and installing, I still do not see the "Keyboad Filter" entry in my target device machine under gpedit.msc. Do I miss something here?

    Thanks.

    Tuesday, November 15, 2011 5:34 AM
  • WEDU updates SP1 DS on the development machine. You want update the answer file to include "Keyboar Filter" package and deploy this answer file.

    ---Sergey

    Tuesday, November 15, 2011 6:32 AM
  • Got it now. Thank you very much.
    • Proposed as answer by BenWang0823 Wednesday, November 16, 2011 2:20 AM
    • Unproposed as answer by BenWang0823 Thursday, November 17, 2011 2:55 AM
    Wednesday, November 16, 2011 2:16 AM
  • After updating, I got Keyboard Filter to work. But we found some very strange behavior with keyboard filter. The login user is administrator and the keyboard filter is enabled. It was working fine at the very beginning. One of our QA engineers just tried to unplug the USB keyboard and plug it back to another USB port. After doing that, the keyboard filter does not work anymore, no matter what we do. We checked the gpedit.msc and nothing is changed there. I wonder what happened here?

    Thank you very much. 

    Thursday, November 17, 2011 3:02 AM
  • Hi BenWang0823

    This is an unusual problem.  The Keyboard Filter is pretty aggressive about filtering keys in any and all keyboards.  There's not a lot that can stop it, certainly not moving keyboards around.  

    What can stop it are:

    1) if the service is stopped.  This shouldn't happen, only a crash or intentional stop.  Run sc query KeyboardFilter

    2) the administrator filtering is disabled.  Ya, the wording is funny, but verify that this option is set to not-configured which should default to filtering for everybody.  Optionally, try Enabled.  If you can, try a non-administrative account which should always be enabled.

    3) some form of error.  Check the log files (eventvwr, Applications and Services Logs, Microsoft, Windows, Keyboard Filter, Admin.  Admin should be empty so any entries might show an obvious problem (hopefully).  Also, enable Operational (but disable when you figure it out).  This will journal what it's doing, like users logging on/off, updates to group policy, the service starting/stopping.  Unfortunately hardware keyboard won't show up here.

    4) time.  there's a 5 second delay after group policy changes.  If the machine is domain joined, it can take a minute.  An undocumented trick: before changing a policy, resize the group policy MMC window.  Make the policy change, and wait for grey borders to appear on the left and right sides.  Once they do, count to 5 Mississippi and the change should be applied.

    Please let us know if you find anything, no matter what it is.  This is a serious problem that we want to address. 

    Brendan


    Thursday, November 17, 2011 5:11 AM
  • I did not test and found the following behavior: Keyboard Filter Service starts up automatically when WES 7 sarts, but does not take any effect since it reports the following error to event log: Could not update keyboard filter subsystem, 系统找不到指定的文件。 (0). The event ID is 10004 Log Name: Microsoft-Windows-KeyboardFilter/Admin But if I stop the Keyboard Filter Service and start it again manually, no error is reported and Keyboard Filter is working properly. I wonder what caused the Keyboard Filter Service to fail when WES 7 starts up. But manually restarting is working. Did I miss something here? When I built the image, all I did was including Keyboard Filter from ICE. Should I do it differently? Thank you very much.
    Thursday, November 17, 2011 8:18 AM
  • I did some test and found the following behavior: Keyboard Filter Service starts up automatically when WES 7 sarts, but does not take any effect since it reports the following error to event log: Could not update keyboard filter subsystem, 系统找不到指定的文件。 (0). The event ID is 10004 Log Name: Microsoft-Windows-KeyboardFilter/Admin But if I stop the Keyboard Filter Service and start it again manually, no error is reported and Keyboard Filter is working properly. I wonder what caused the Keyboard Filter Service to fail when WES 7 starts up. But manually restarting is working. Did I miss something here? When I built the image, all I did was including Keyboard Filter from ICE. Should I do it differently? Thank you very much.
    Thursday, November 17, 2011 8:20 AM
  • I did some more test. My shell is a WPF application. So I restart the Keyboard Filter Service from my wpf application when the main window is loaded. The Keyboard Filter works fine. I unplug the USB keyboard and plug it in another USB port, the keyboard filter no longer works. After I close and restart my WPF application, which restarts the Keyboard Filter Service, the keyboard filter is working again. The chance of unplugging the keyboard is low anyway. I am still wondering why the Keyboard Filter Service does not work properly when WES 7 starts.

    My work around which requires some funny codes in my application will certaily works for us. But I wonder if there is any better way to do it. Any suggestion would be appreciated.

    Thank you very much.

    Thursday, November 17, 2011 9:03 AM
  • Hi BenWang0823,

    First, thanks so much for letting us know this issue and keeping us updated.  Restarting the service is simply not something you should have to do. 

    I don't have any easy answers yet but I'll forward this thread to the dev/test team working on it.  It could also be something embedded related such as a missing dependency or something unique to your setup, but we'll try to replicate it here.

    We'll post any information here the minute we find it.  If there's anything you can post on your configuration, such as packages you use or avoid, that might help us as well.

    Brendan

    Thursday, November 17, 2011 7:37 PM
  • Thank you very much for the reply. All I did was adding Keyboard Filter to my answer file from ICE. I validated it and it passed the validation. I think it might be the Keyboard Filter Service start up sequence when WES 7 boots. Otherwise it should report the same error when restarting. If you think the answer file is helpful, I am more than happy to post it here. Please let me know.

    Thanks. Really appreciate the reply in this thread.

    Thursday, November 17, 2011 10:52 PM
  • Its a good news that we have keyboard filter now as a feature. I have a question related to keyboard filter.

    After installation of the keyboard filter how can i enable or disable key combinations like CTRL+ALT+DEL from command prompt 

    I know we can do it using gpedit.msc but how can we do it using command prompt. 

    Tuesday, November 22, 2011 10:44 AM
  • Trace the registry key and than set it manually.
    All GP settings are registry settings.. you can trace it with e.g. RegFromApp from Nirsoft or Regshot or anything else. Then set the key with GPedit on the dev machine and trace the difference... extract the key and import it to the final image in the way you want.
    Windows Embedded Developer and Scripting Guy //Germany
    • Edited by KNARZ Tuesday, November 22, 2011 2:08 PM
    Tuesday, November 22, 2011 2:08 PM
  • Hi Saifan,

    Check out a file called \windows\policydefinitions\keyboardfilter.admx.  It has all the registry keys you'll need in XML format.  If you're curious, the text is localized in en-us subdirectory.

    Brendan

    Tuesday, November 22, 2011 4:29 PM
  • Thanks for such a quick response. I was able to use the keyboard filter using command prompt by adding the command.

    For ex:

    REG ADD HKLM\Software\Policies\Microsoft\KeyBoardFilter /V CTRL+ALT+DEL /t REG_DWORD /D 1 /F

    • Edited by Saifan Wednesday, November 23, 2011 10:15 AM
    Wednesday, November 23, 2011 10:12 AM
  • BenWang0823,

    To introduce myself, I am one of the SDETs on EEF's team. I had few questions for you to help us understand your usage scenarios

    1) Under what scenarios do you restart Keyboard filter service and why? Do you enumnerate or register for device changes inside you shell app?
    2) Is at an acceptable risk to allow users to add/remove physical hardware including keyboard your devices? If so what types of hardware is allowed?


    Also, are you working as an OEM? If so can you create an service incident thru http://support.microsoft.com/select/Default.aspx?target=assistance. It will help facilitate exchange of details.

    If you are an end-user, can you contact your OEM to get an service incident opened?

    Monday, November 28, 2011 8:03 PM
  • I just added the keyboard-filter.cab using DISM /online and added the registry key mentioned above. Works fine!

    Friday, July 6, 2012 8:56 AM
  • For what it's worth, I have also seen the issue BenWang0823 reported.
    At startup, the Keyboard Filter service logs "Could not update keyboard filter subsystem, The system cannot find the file specified. (0)."  Error 10004
    The filter is not active (I can C-A-D, etc) until I stop it and start it again.
    I also am using an application as a shell, but an MFC app, not a WPF one, however if I boot to the desktop instead of my application, I see the same issue. 
    If I go to the services control panel and restart the Keyboard Filter service, my filtering then takes effect.

    -MM

    Tuesday, July 10, 2012 2:32 PM
  • I cannot find anything about keyboard filter in ICE help nor using ICE search. Is keyboard-filter installed by default?
    Tuesday, July 10, 2012 3:34 PM
  • It is not installed by default. Use WEDU to download the latest updates for an SP1 distribution share, and the keyboard filter will be one of the updates.

    -Sean


    www.sjjmicro.com / www.seanliming.com / www.annabooks.com, Book Author - Pro Guide to WES 7, XP Embedded Advanced, Pro Guide to POS for .NET

    Tuesday, July 10, 2012 5:22 PM
    Moderator
  • I have a strange situation here. I have two DS64SP1 distribution shares, the first one I worked with for the past four weeks. There are things like "Keyboard Filter" and "EWF Management Tool" under EEF features.

    Yesterday, I reinstalled the toolkit and created a new DS64SP1 DS during install. I'm missing all the SP1 EEF features in the new DS? I have downloaded the WES7 image from MSDN, it is named "en_windows_embedded_standard_7_sp1_runtime_x64_dvd_651894". I'm a bit confused to be honest....


    EDIT: I noticed a couple files in DS64SP1\OOBInstalls named according to the EEF SP1 features. Also the keyboard-filter.cab is present in the folder structure of the new DS. But why is it not displayed unter EEF in ICE?
    Wednesday, July 11, 2012 7:37 AM
  • Keyboard Filter EWF Management tool are updates to the ditribution shares. a Clean install will not have them. You must have ran WEDU on the other distribution share or downloaded the updates from the ECE website.

    -Sean


    www.sjjmicro.com / www.seanliming.com / www.annabooks.com, Book Author - Pro Guide to WES 7, XP Embedded Advanced, Pro Guide to POS for .NET

    Wednesday, July 11, 2012 2:53 PM
    Moderator
  • ECE updates: And import the updates with ICE.


    Windows Embedded Developer and Scripting Guy //Germany (Preparing a blog about Windows Embedded Standard)

    Wednesday, July 11, 2012 3:59 PM
  • Keyboard Filter EWF Management tool are updates to the ditribution shares. a Clean install will not have them. You must have ran WEDU on the other distribution share or downloaded the updates from the ECE website.

    -Sean


    www.sjjmicro.com / www.seanliming.com / www.annabooks.com, Book Author - Pro Guide to WES 7, XP Embedded Advanced, Pro Guide to POS for .NET

    Well, I ran WEDU on the new DS like I did it on the old one. The difference is, however, on the new DS I don't have alll the new EEF features unter FeaturePack\EEF.

    I'm going to create a new thread for this.


    Thursday, July 12, 2012 2:10 PM
  • Hi,

    I just discovered that the keyboard filter only works when the keyboard is plugged in before Windows starts. If I plug it after Windows starts then no key combinations are blocked. I disabled all the key combinations with gpedit.msc, everything except the Shift key.

    Any more ideas? It seems that this is a long issue and has not been fixed till now.

    Thanks,

    Igor

    Monday, October 29, 2012 9:33 PM
  • Does it work if you restart the keyboard filter service?

    net stop "Keyboard Filter" && net start "Keyboard Filter"


    Tuesday, October 30, 2012 7:31 AM
  • it should work than.

    use 2 lines or only one &.


    Windows Embedded Developer and Scripting Guy //Germany (Preparing a blog about Windows Embedded Standard)

    Tuesday, October 30, 2012 2:23 PM
  • The issue above with the keys not being filtered with a late plugged in keyboard seem to be resolved with a patch, KB2685747.  However, the patch is against the POSReady 7, not Windows Embedded 7.  I've tried in against WES7 and it seems to work for that problem.

    I've got a second problem with it, where it's possible to get it into a state where it leaks keystrokes that should be filtered.

    If anybody has a good alternative, I'm all ears.

    Monday, March 18, 2013 10:35 PM
  • I noticed that the keyboardFilter sometimes fails after a new USB device has been installed even though it shows up as running in service.msc. A restart of the service gets it going again. We are trying to lock  down the machine, so restarting the service is not an option. I even changed the restart options for the service and that did not help.

    It looks like KB2685747 takes care of that issue. Has anyone run had any problems with KB2685747 on WES7? I ask because it is not one of the updates that comes through via Windows® Embedded Developer Update

    • Proposed as answer by Jags - MS Thursday, March 21, 2013 6:17 AM
    • Unproposed as answer by Jags - MS Thursday, March 21, 2013 6:17 AM
    Wednesday, March 20, 2013 7:01 PM
  • Hi Dan,

    Yes KB2685747  will take care of the issue and this KB is available in WEDU  for WES7SP1 distribution share as well.I did a quick check on WES7SP1. I removed the keyboard and connected to another USB port.Still the KB filter is running fine after applying the KB2685747.

    Thanks,

    Jags

    • Proposed as answer by Jags - MS Thursday, March 21, 2013 6:23 AM
    • Unproposed as answer by Jags - MS Thursday, March 21, 2013 6:23 AM
    • Proposed as answer by Jags - MS Thursday, March 21, 2013 6:28 AM
    Thursday, March 21, 2013 6:23 AM
  • Thanks Jags. I ran WEDU yesterday and it wasn't included. I'll keep an eye on it.
    • Proposed as answer by Dan Hagarty Thursday, March 21, 2013 12:20 PM
    • Unproposed as answer by Dan Hagarty Thursday, March 21, 2013 12:20 PM
    Thursday, March 21, 2013 12:20 PM
  • I found KB2685747 works fine on WES7 and keeps the filter working even with keyboards plugged in "late".

    However, it is possible to get keys to leak through the filter if you "abuse" the modifier keys (Shift, Alt, and probably Ctrl)

    For example, fast typing Shift-Enter-Shift-Enter-Shift, or Alt-Backspace-Alt-Backspace, Alt-Esc-Alt-Esc can cause additional filtered keys to leak through the filter.

    So, use a custom filter:

    Shift
    LShift
    RShift

    Shift-Enter
    LShift-Enter
    RShift-Enter

    Note, these are just the ones for Shift and the Enter key.
    I've also caught the filter passing Escape and Backspace after hitting Alt-Backspace-Alt-Backspace, so....
    Similar sets for Alt and Ctrl would be helpful, as would any other key you want filtered (Escape, Backspace, etc...)

    I wrote a quick dialog app, and overloaded PreTranslateMessage() method and stuffed all the keystrokes into a listbox then dropped them from further processing.  This allows one to trivially see all the keys fed to ones application, and it's how I was able to observe the leakage.

    Friday, March 22, 2013 7:30 PM
  • Please refer to the below link for the issue you mentioned.

    http://msdn.microsoft.com/en-US/library/hh505883(v=WinEmbedded.60).aspx

    Hh505883.note(en-US,WinEmbedded.60).gifNote:

    When blocking cursor keys (Left, Right, Up, Down, and so on), you may want to add a key filter to block them with modifiers as well. For example, when blocking the Left cursor key, also add a filter for Shift+Left. Otherwise, the Shift+Left key combination may circumvent the Left key filter.

    Monday, March 25, 2013 6:28 AM
  • Hi Jags,

    That link is useful, but incomplete.....

    It does not really indicate that any key you want to filter should be included in the custom key region with three variants: KEY + Shift, KEY + LShift, KEY + RShift.  

    Not just arrow keys.

    If you use the standard filters, and play nice with the combinations when testing, you'll never know it's trivially breakable.  And once broken, it's not jut KEY that leaks.  Various others do too.

    Anyway, I've said my piece too many times already.  I don't want others to go through the headache I did after finding keys that SHOULD have been filtered weren't.

    Thursday, April 25, 2013 7:39 PM
  • Hi Charles,

    Yes that link has to be updated to say that this is not just applicable to cursor/arrow keys but all the custom keys. I shall follow-up on this with the concerned owners and shall try to get it corrected. I will updated this thread once the link is updated. Thanks.

    Thursday, May 2, 2013 10:42 PM
  • Apparently this is still an issue. My QA Engineer can break the filter in a heart beat. We plugged 4 keyboards and 1 mouse at the same time and "bingo" now the policy does not prevent keyboards from being used. We checked the registry and we checked gpedit.msc all settings are still ENABLED but I can type ctrl + alt + del, I can type any hot key that we disabled and they work.

    I stopped the service and restarted the filter started to work again only to find out that if I switch the port of the usb hub the keyboard filter no longer works.

    Please let me know if there is a patch to fix this issue. thanks.

    Tuesday, October 3, 2017 5:24 PM
  • Since this is WES7, I would raise the issue with Microsoft directly or through a distributor to see if there is a fix or patch available or if they can figure out a solution.

    EDIT: Did you include all the latest updates?


    Sean Liming - Book Author: Starter Guide Windows 10 IoT Enterprise - www.annabooks.com / www.seanliming.com


    Tuesday, October 3, 2017 8:54 PM
    Moderator