Add blocked key combinations

Supported Editions
✅ IoT Enterprise LTSC
✅ IoT Enterprise
✅ Enterprise LTSC
✅ Enterprise
✅ Education

The following sample Windows PowerShell script uses the Windows Management Instrumentation (WMI) providers for Keyboard Filter to create three functions to configure Keyboard Filter so that Keyboard Filter blocks key combinations. It demonstrates several ways to use each function.

The first function, Block-Predefined-Key, blocks key combinations that are predefined for Keyboard Filter.

The second function, Block-Custom-Key, blocks custom key combinations by using the English key names.

The third function, Block-Scancode, blocks custom key combinations by using the keyboard scan code for the key.

Block-rules.ps1

#
# Copyright (C) Microsoft. All rights reserved.
#

<#
.Synopsis
    This script shows how to use the built-in WMI providers to create and
    activate Keyboard Filter blocking rules through Windows PowerShell on
    the local computer.
.Parameter ComputerName
    Optional parameter to specify a remote machine that this script should
    manage.  If not specified, the script will execute all WMI operations
    locally.
#>
param (
    [String] $ComputerName
)

$CommonParams = @{"namespace"="root\standardcimv2\embedded"}
$CommonParams += $PSBoundParameters

function Block-Predefined-Key($Id) {
    <#
    .Synopsis
        Block a predefined key combination.
    .Description
        Use Get-WMIObject to enumerate WEKF_PredefinedKey instances, find the
        instance matching Id, and set its Enabled property to 1. Enabled refers
        to the blocking rule; when the rule is enabled, the key combination is
        blocked.
    .Example
        Block-Predefined-Key "Ctrl+Alt+Del"
        Blocks the Ctrl+Alt+Delete key combination.
#>

    $predefined = Get-WMIObject -class WEKF_PredefinedKey @CommonParams |
        where {
            $_.Id -eq "$Id"
        };

    if ($predefined) {
        $predefined.Enabled = 1;
        $predefined.Put() | Out-Null;
        Write-Host "Activated predefined-key blocking rule for $Id"
    } else {
        Write-Error "$Id is not a valid predefined key"
    }
}


function Block-Custom-Key($Id) {
    <#
    .Synopsis
        Block a custom key combination.
    .Description
        Use Get-WMIObject to enumerate WEKF_CustomKey instances, find the
        instance matching Id, and set its Enabled property to 1. Enabled refers
        to the blocking rule; when the rule is enabled, the key combination is
        blocked.

        If the custom-key instance doesn't exist, add a new WEKF_CustomKey
        instance by using Set-WMIInstance.
    .Example
        Block-Custom-Key "Ctrl+V"
        Blocks the Ctrl+V key combination.
#>

    $custom = Get-WMIObject -class WEKF_CustomKey @CommonParams |
        where {
            $_.Id -eq "$Id"
        };

    if ($custom) {
        # The rule exists. Activate the blocking rule.
        $custom.Enabled = 1;
        $custom.Put() | Out-Null;
        "Activated custom-key blocking rule for $Id";

    } else {
        Set-WMIInstance `
            -class WEKF_CustomKey `
            -argument @{Id="$Id"} `
            @CommonParams | Out-Null
        "Added custom-key blocking rule for $Id.";
    }
}

function Block-Scancode($Modifiers, [int]$Code) {
    <#
    .Synopsis
        Block a key combination identified by its scan code.
    .Description
        Use Get-WMIObject to enumerate WEKF_Scancode instances, find the
        instance matching Modifiers and Scancode, and set its Enabled property
        to 1. Enabled refers to the blocking rule; when the rule is enabled,
        the key combination is blocked.

        If the scan-code instance doesn't exist, add a new WEKF_Scancode
        instance by using Set-WMIInstance.
    .Example
        Block-Scancode "Ctrl" 37
        Blocks Ctrl combined with keyboard scan code 37 (base 10).
#>

    $scancode =
        Get-WMIObject -class WEKF_Scancode @CommonParams |
            where {
                ($_.Modifiers -eq $Modifiers) -and ($_.Scancode -eq $Code)
            }

    if($scancode) {
        $scancode.Enabled = 1
        $scancode.Put() | Out-Null
        "Activated scan-code blocking rule for {0}+{1:X4}" -f $Modifiers, $Code
    } else {
        Set-WMIInstance `
            -class WEKF_Scancode `
            -argument @{Modifiers="$Modifiers"; Scancode=$Code} `
            @CommonParams | Out-Null

        "Added scan-code blocking rule for {0}+{1:X4}" -f $Modifiers, $Code
    }
}

# Some example uses of the functions defined above.
Block-Predefined-Key "Ctrl+Alt+Del"
Block-Predefined-Key "Ctrl+Esc"
Block-Custom-Key "Ctrl+V"
Block-Custom-Key "Numpad0"
Block-Custom-Key "Shift+Numpad1"
Block-Custom-Key "Shift+5"
Block-Scancode "Ctrl" 37

Related topics

Windows PowerShell script samples for keyboard filter

Keyboard filter WMI provider reference

Keyboard filter