Lock Down Key Combos on a Windows VPS with Keyboard Filter

If you run a Windows VPS that doubles as a kiosk, a locked-down signage box, or a single-purpose application host, you often want to stop users from reaching the shell with familiar key combinations. The built-in Keyboard Filter feature is designed for exactly this: it intercepts keystrokes at the system level and suppresses the ones you nominate, from the Windows key to arbitrary custom combos. This guide walks through installing and configuring it entirely over RDP and PowerShell.

What Keyboard Filter does (and where it lives)

Keyboard Filter is an optional Windows component that runs as a service and quietly drops key events before applications see them. It ships with a specific set of Windows editions (typically Enterprise and IoT Enterprise), so it is not guaranteed to be present on every VPS image. Before you plan around it, confirm it is offered on your instance:

Get-WindowsOptionalFeature -Online -FeatureName Client-KeyboardFilter

If the feature is listed, you can proceed. If it is absent, your edition does not support it and you will need a different approach (Group Policy restrictions, AppLocker, or a kiosk/assigned-access configuration) rather than inventing one.

Install the feature

Open an elevated PowerShell session on the VPS over RDP and enable the component:

Enable-WindowsOptionalFeature -Online -FeatureName Client-KeyboardFilter -All

A reboot is usually required. Because you are connected over Remote Desktop, restart deliberately and wait for the RDP listener to come back before reconnecting:

Restart-Computer -Force

After the reboot, the Microsoft Keyboard Filter service handles the interception. You configure its behaviour not through a GUI but through WMI classes in the root\standardcimv2\embedded namespace.

Protect your own access first

Before you block anything, think about the obvious risk: on a remote server, your only way in is the keyboard and mouse over RDP. If you suppress combinations that your own tools rely on, you can make the box harder to administer. Keyboard Filter exposes a setting to exempt administrator accounts from filtering, which is sensible on a VPS you manage remotely:

$settings = Get-WmiObject -Namespace root\standardcimv2\embedded -Class WEKF_Settings
$settings.DisableKeyboardFilterForAdministrators = $true
$settings.Put()

With this on, filtering applies to standard users while you retain full shortcut access as an admin.

Block predefined key combinations

The WEKF_PredefinedKey class holds a catalogue of well-known combinations, each identified by a string Id such as the Windows key or task switchers. List what is available and its current state:

Get-WmiObject -Namespace root\standardcimv2\embedded -Class WEKF_PredefinedKey |
    Select-Object Id, Enabled

To block one, fetch it by Id, flip Enabled to true, and commit the change. For example, to suppress the Windows key:

$key = Get-WmiObject -Namespace root\standardcimv2\embedded `
    -Class WEKF_PredefinedKey -Filter "Id='Win'"
$key.Enabled = $true
$key.Put()

Repeat for other entries in the list, such as the task-switcher and application-close combinations, using the exact Id values that your enumeration returned. Always drive the list from what the system reports rather than assuming a particular combo exists.

Block custom and raw-scancode keys

For combinations not in the predefined list, use WEKF_CustomKey. You express the combo as a string of modifiers plus a key, for example Ctrl+V or Shift+F10:

Set-WmiInstance -Namespace root\standardcimv2\embedded `
    -Class WEKF_CustomKey -Arguments @{ Id = 'Ctrl+V' }

When a key sends no usable virtual-key value, or you want to target hardware at the lowest level, WEKF_Scancode lets you block by modifier and scancode. This is more fragile because scancodes vary by keyboard, so reserve it for cases the custom-key approach cannot cover, and test carefully.

To review everything you have configured:

Get-WmiObject -Namespace root\standardcimv2\embedded -Class WEKF_CustomKey
Get-WmiObject -Namespace root\standardcimv2\embedded -Class WEKF_Scancode

To stop blocking a custom key, retrieve its instance and call Delete() on it, or set the matching predefined key's Enabled back to false.

A critical caveat for RDP

Keyboard Filter operates on the server's own input stack. How a shortcut behaves inside a Remote Desktop session also depends on the client and its "apply Windows key combinations" setting, and some combos are translated on the way in (the secure attention sequence, for instance, reaches a remote session as Ctrl+Alt+End rather than Ctrl+Alt+Del). Because of this, the most reliable way to confirm your rules is to test against the real scenario you are locking down — the console session or the exact RDP client your users will use — rather than assuming behaviour carries over identically.

Verify and document

After configuring, confirm the service is running and sign in as a standard (non-admin) user to check that the blocked combinations no longer reach the desktop, while your admin access stays intact. Keep a short script of the exact WMI commands you applied so the configuration is reproducible if you rebuild the VPS. Treating the keyboard policy as code — versioned and re-runnable — beats clicking through settings you cannot later reconstruct.