Microsoft-Windows-KeyboardFilter

Event	Title	Channel	Sample	Rule
10001	The Keyboard Filter Service was unable to obtain the session token from the …	Admin	N	N
10002	The Keyboard Filter Service was unable to obtain access to Terminal Services: …	Admin	N	N
10003	Could not obtain a lock on local policy settings for update detection, Message …	Admin	N	N
10004	Could not update keyboard filter subsystem, Message (ErrorCode).	Admin	N	N
10005	The Keyboard Filter Service could not start session monitor.	Admin	N	N
10006	Session Manager handle to Keyboard Filter process was abandoned.	Admin	N	N
10007	The Keyboard Filter Service failed to launch hook process.	Admin	N	N
10008	'sdbinst -q (SdbPath)' has probably failed, exit code of (ExitCode).	Admin	N	N
10009	Unsupported.	Admin	N	N
10010	Keyboard Filter Driver could not start and has unloaded.	Admin	N	N
10011	The Keyboard Filter Driver could not attach to keyboard.	Admin	N	N
10012	The Keyboard Filter Driver could not properly filter keystroke information.	Admin	N	N
10013	The Keyboard Filter Driver could not update filter configuration.	Admin	N	N
10014	A non-empty list of keyboard filter rules resulted in an empty scancode list.	Admin	N	N
10015	Error was returned when trying to transform a keyboard filter rule to a …	Admin	N	N
10016	Attempting to launch the keyboard filter hook process.	Operational	N	N
10050	Failed to attach session Message (ErrorCode).	Admin	N	N
10051	Failed to detach session Message (ErrorCode).	Admin	N	N
10052	Missing Breakout keycode	Admin	N	N
10053	IOCTLReadBreakoutKeyFailed Message (ErrorCode).	Admin	N	N
10054	CreateResources failed Message (ErrorCode).	Admin	N	N
10055	RPC initialization failed Message (ErrorCode).	Admin	N	N
10056	BreakoutKey thread launch failure Message (ErrorCode).	Admin	N	N
10057	Run failed while waiting on handles Message (ErrorCode).	Admin	N	N
10058	Set KeyboardLayout failed Message (ErrorCode).	Admin	N	N
10059	RegisterDeviceNotification failed Message (ErrorCode).	Admin	N	N
10101	The Keyboard Filter Service has Started	Operational	N	N
10102	The Keyboard Filter Service has stopped	Operational	N	N
10103	Generic Keyboard Filter Service message: …	Operational	N	N
10104	'sdbinst -q (SdbPath)' executed, exit code (ExitCode).	Operational	N	N
10201	Administrator user UserName is now logged on, keyboard filtering is disabled for …	Operational	N	N
10202	User UserName logged off.	Operational	N	N
10203	User UserName logged off.	Operational	N	N
10204	User UserName is now logged on.	Operational	N	N
10205	The Keyboard Filter Service has detected Policy changes and is reloading them	Operational	N	N
10206	The Keyboard Filter Service has detected a layout change to Layout.	Operational	N	N
10207	The Keyboard Filter Service has found the following enabled policies.	Operational	N	N
10208	The Keyboard Filter Service is sending scancodes to the Filter Driver.	Operational	N	N
10301	A custom filter appears to have an invalid modifier (system) key.	Admin	N	N
10302	A custom filter (Filter) appears to have an invalid key.	Admin	N	N
10303	A custom filter (Filter) appears to be invalid.	Admin	N	N
10304	Too many custom filters have been enabled.	Admin	N	N
11000	Hardware keyboard input	Performance	N	N
11001	Hardware keyboard input	Performance	N	N
11002	Software keyboard input	Performance	N	N
11003	Software keyboard input	Performance	N	N
11004	Load Configuration	Performance	N	N
11005	Load Configuration	Performance	N	N
11006	Keybaord Layout Change	Performance	N	N
11007	Keybaord Layout Change	Performance	N	N
11008	Desktop Change	Performance	N	N
11009	Desktop Change	Performance	N	N
11010	User login	Performance	N	N
11011	User login	Performance	N	N
11012	User logout	Performance	N	N
11013	User logout	Performance	N	N

Event ID 10001: The Keyboard Filter Service was unable to obtain the session token from the session id: Message (ErrorCode).

Channel: Admin
Task: MicrosoftKeyboardFilterService
Opcode: Start

Description

The Keyboard Filter Service was unable to obtain the session token from the session id: Message (ErrorCode). Please verify that Terminal Services client is installed and the service is running under the LocalSystem user.

Message #

The Keyboard Filter Service was unable to obtain the session token from the session id: %1 (%2).   Please verify that Terminal Services client is installed and the service is running under the LocalSystem user.

Fields #

Name	Description
`Message` UnicodeString
`ErrorCode` UInt32

Event ID 10002: The Keyboard Filter Service was unable to obtain access to Terminal Services: Message (ErrorCode).

Channel: Admin
Task: MicrosoftKeyboardFilterService
Opcode: Start

Description

The Keyboard Filter Service was unable to obtain access to Terminal Services: (). Please verify that the Terminal Services client is installed and the service is running under the LocalSystem user.

Message #

The Keyboard Filter Service was unable to obtain access to Terminal Services: %1 (%2). Please verify that the Terminal Services client is installed and the service is running under the LocalSystem user.

Fields #

Name	Description
`Message` UnicodeString
`ErrorCode` UInt32

Event ID 10003: Could not obtain a lock on local policy settings for update detection, Message (ErrorCode).

Channel: Admin
Task: MicrosoftKeyboardFilterService

Message #

Could not obtain a lock on local policy settings for update detection, %1 (%2).

Fields #

Name	Description
`Message` UnicodeString
`ErrorCode` UInt32

Event ID 10004: Could not update keyboard filter subsystem, Message (ErrorCode).

Channel: Admin
Task: MicrosoftKeyboardFilterService

Message #

Could not update keyboard filter subsystem, %1 (%2).

Fields #

Name	Description
`Message` UnicodeString
`ErrorCode` UInt32

Event ID 10005: The Keyboard Filter Service could not start session monitor.

Channel: Admin
Task: MicrosoftKeyboardFilterService

Description

The Keyboard Filter Service could not start session monitor. The session monitor ensures keyboard layout changes are reflected within the service and that on-screen keyboards work correctly. Check to make sure system permissions are set up correctly. Reason, Message (ErrorCode).

Message #

The Keyboard Filter Service could not start session monitor. The session monitor ensures keyboard layout changes are reflected within the service and that on-screen keyboards work correctly.  Check to make sure system permissions are set up correctly.  Reason, %1 (%2).

Fields #

Name	Description
`Message` UnicodeString
`ErrorCode` UInt32

Event ID 10006: Session Manager handle to Keyboard Filter process was abandoned.

Channel: Admin
Task: MicrosoftKeyboardFilterService

Description

Session Manager handle to Keyboard Filter process was abandoned. Handle will be removed from the session list.

Message #

Session Manager handle to Keyboard Filter process was abandoned. Handle will be removed from the session list.

Event ID 10007: The Keyboard Filter Service failed to launch hook process.

Channel: Admin
Task: MicrosoftKeyboardFilterService

Description

The Keyboard Filter Service failed to launch hook process. Reason: Message.

Message #

The Keyboard Filter Service failed to launch hook process.  Reason: %1

Fields #

Name	Description
`Message` UnicodeString
`ErrorCode` UInt32

Event ID 10008: 'sdbinst -q (SdbPath)' has probably failed, exit code of (ExitCode).

Channel: Admin
Task: MicrosoftKeyboardFilterService

Message #

'sdbinst -q (%1)' has probably failed, exit code of (%2).

Fields #

Name	Description
`SdbPath` UnicodeString
`ExitCode` UInt32

Event ID 10009: Unsupported.

Channel: Admin
Task: MicrosoftKeyboardFilterService

Description

Unsupported (e.g. remote) session was disconnected by Keyboard Filter Service.

Message #

Unsupported (e.g. remote) session was disconnected by Keyboard Filter Service.

Event ID 10010: Keyboard Filter Driver could not start and has unloaded.

Channel: Admin
Task: MicrosoftKeyboardFilterService

Description

Keyboard Filter Driver could not start and has unloaded. Reason, ErrorCode (Reason).

Message #

Keyboard Filter Driver could not start and has unloaded.  Reason, %1 (%2).

Fields #

Name	Description
`ErrorCode` UInt32
`Reason` UInt32

Event ID 10011: The Keyboard Filter Driver could not attach to keyboard.

Channel: Admin
Task: MicrosoftKeyboardFilterService

Description

The Keyboard Filter Driver could not attach to keyboard. Reason, ErrorCode (Reason).

Message #

The Keyboard Filter Driver could not attach to keyboard.  Reason, %1 (%2).

Fields #

Name	Description
`ErrorCode` UInt32
`Reason` UInt32

Event ID 10012: The Keyboard Filter Driver could not properly filter keystroke information.

Channel: Admin
Task: MicrosoftKeyboardFilterService

Description

The Keyboard Filter Driver could not properly filter keystroke information. Reason, ErrorCode (Reason).

Message #

The Keyboard Filter Driver could not properly filter keystroke information.  Reason, %1 (%2).

Fields #

Name	Description
`ErrorCode` UInt32
`Reason` UInt32

Event ID 10013: The Keyboard Filter Driver could not update filter configuration.

Channel: Admin
Task: MicrosoftKeyboardFilterService

Description

The Keyboard Filter Driver could not update filter configuration. Reason, ErrorCode (Reason).

Message #

The Keyboard Filter Driver could not update filter configuration.  Reason, %1 (%2).

Fields #

Name	Description
`ErrorCode` UInt32
`Reason` UInt32

Event ID 10014: A non-empty list of keyboard filter rules resulted in an empty scancode list.

Channel: Admin
Task: MicrosoftKeyboardFilterService

Event ID 10015: Error was returned when trying to transform a keyboard filter rule to a scancode.

Channel: Admin
Task: MicrosoftKeyboardFilterService

Fields #

Name	Description
`Message` UnicodeString
`ErrorCode` UInt32

Event ID 10016: Attempting to launch the keyboard filter hook process.

Channel: Operational
Task: MicrosoftKeyboardFilterService

Event ID 10050: Failed to attach session Message (ErrorCode).

Channel: Admin
Task: MicrosoftKeyboardFilterService

Message #

Failed to attach session %1 (%2)

Fields #

Name	Description
`Message` UnicodeString
`ErrorCode` UInt32

Event ID 10051: Failed to detach session Message (ErrorCode).

Channel: Admin
Task: MicrosoftKeyboardFilterService

Message #

Failed to detach session %1 (%2)

Fields #

Name	Description
`Message` UnicodeString
`ErrorCode` UInt32

Event ID 10052: Missing Breakout keycode

Channel: Admin
Task: MicrosoftKeyboardFilterService

Event ID 10053: IOCTLReadBreakoutKeyFailed Message (ErrorCode).

Channel: Admin
Task: MicrosoftKeyboardFilterService

Message #

IOCTLReadBreakoutKeyFailed %1 (%2)

Fields #

Name	Description
`Message` UnicodeString
`ErrorCode` UInt32

Event ID 10054: CreateResources failed Message (ErrorCode).

Channel: Admin
Task: MicrosoftKeyboardFilterService

Message #

CreateResources failed %1 (%2)

Fields #

Name	Description
`Message` UnicodeString
`ErrorCode` UInt32

Event ID 10055: RPC initialization failed Message (ErrorCode).

Channel: Admin
Task: MicrosoftKeyboardFilterService

Message #

RPC initialization failed %1 (%2)

Fields #

Name	Description
`Message` UnicodeString
`ErrorCode` UInt32

Event ID 10056: BreakoutKey thread launch failure Message (ErrorCode).

Channel: Admin
Task: MicrosoftKeyboardFilterService

Message #

BreakoutKey thread launch failure %1 (%2)

Fields #

Name	Description
`Message` UnicodeString
`ErrorCode` UInt32

Event ID 10057: Run failed while waiting on handles Message (ErrorCode).

Channel: Admin
Task: MicrosoftKeyboardFilterService

Message #

Run failed while waiting on handles %1 (%2)

Fields #

Name	Description
`Message` UnicodeString
`ErrorCode` UInt32

Event ID 10058: Set KeyboardLayout failed Message (ErrorCode).

Channel: Admin
Task: MicrosoftKeyboardFilterService

Message #

Set KeyboardLayout failed %1 (%2)

Fields #

Name	Description
`Message` UnicodeString
`ErrorCode` UInt32

Event ID 10059: RegisterDeviceNotification failed Message (ErrorCode).

Channel: Admin
Task: MicrosoftKeyboardFilterService

Message #

RegisterDeviceNotification failed %1 (%2)

Fields #

Name	Description
`Message` UnicodeString
`ErrorCode` UInt32

Event ID 10101: The Keyboard Filter Service has Started

Channel: Operational
Task: MicrosoftKeyboardFilterService

Event ID 10102: The Keyboard Filter Service has stopped

Channel: Operational
Task: MicrosoftKeyboardFilterService
Opcode: Stop

Event ID 10103: Generic Keyboard Filter Service message: Generic_Keyboard_Filter_Service_message.

Channel: Operational
Task: MicrosoftKeyboardFilterService

Message #

Generic Keyboard Filter Service message: %1

Fields #

Name	Description
`Command` UnicodeString

Event ID 10104: 'sdbinst -q (SdbPath)' executed, exit code (ExitCode).

Channel: Operational
Task: MicrosoftKeyboardFilterService

Message #

'sdbinst -q (%1)' executed, exit code (%2)

Fields #

Name	Description
`SdbPath` UnicodeString
`ExitCode` UInt32

Event ID 10201: Administrator user UserName is now logged on, keyboard filtering is disabled for this session.

Channel: Operational
Task: MicrosoftKeyboardFilterService

Message #

Administrator user %1 is now logged on, keyboard filtering is disabled for this session.

Fields #

Name	Description
`UserName` UnicodeString

Event ID 10202: User UserName logged off.

Channel: Operational
Task: MicrosoftKeyboardFilterService

Description

User UserName logged off. Keyboard filtering is disabled for the Windows Logon Screen.

Message #

User %1 logged off. Keyboard filtering is disabled for the Windows Logon Screen.

Fields #

Name	Description
`UserName` UnicodeString

Event ID 10203: User UserName logged off.

Channel: Operational
Task: MicrosoftKeyboardFilterService

Description

User UserName logged off. Keyboard filtering is disabled.

Message #

User %1 logged off. Keyboard filtering is disabled.

Fields #

Name	Description
`UserName` UnicodeString

Event ID 10204: User UserName is now logged on.

Channel: Operational
Task: MicrosoftKeyboardFilterService

Description

User UserName is now logged on. Keyboard filtering is now in effect.

Message #

User %1 is now logged on. Keyboard filtering is now in effect.

Fields #

Name	Description
`UserName` UnicodeString

Event ID 10205: The Keyboard Filter Service has detected Policy changes and is reloading them

Channel: Operational
Task: MicrosoftKeyboardFilterService
Opcode: ReadRegistry

Event ID 10206: The Keyboard Filter Service has detected a layout change to Layout.

Channel: Operational
Task: MicrosoftKeyboardFilterService

Message #

The Keyboard Filter Service has detected a layout change to %1.

Fields #

Name	Description
`Layout` UnicodeString

Event ID 10207: The Keyboard Filter Service has found the following enabled policies.

Channel: Operational
Task: MicrosoftKeyboardFilterService
Opcode: ReadRegistry

Fields #

Name	Description
`Count` UInt32
`Policy` UnicodeString

Event ID 10208: The Keyboard Filter Service is sending scancodes to the Filter Driver.

Channel: Operational
Task: MicrosoftKeyboardFilterService
Opcode: WriteDriver

Fields #

Name	Description
`Count` UInt32
`KeyData` AnsiString

Event ID 10301: A custom filter appears to have an invalid modifier (system) key.

Channel: Admin
Task: KeyboardFilterConfiguration

Description

A custom filter (Filter) appears to have an invalid modifier (system) key. Valid modifiers include Ctrl or Control, Alt, Shift, and Win or Windows. Each key must be separated from the one that follows with a plus (+).

Message #

A custom filter (%1) appears to have an invalid modifier (system) key. Valid modifiers include Ctrl or Control, Alt, Shift, and Win or Windows. Each key must be separated from the one that follows with a plus (+).

Fields #

Name	Description
`Filter` UnicodeString

Event ID 10302: A custom filter (Filter) appears to have an invalid key.

Channel: Admin
Task: KeyboardFilterConfiguration

Description

A custom filter (Filter) appears to have an invalid key. Keys can be any character on the system's keyboard or it's name. Please see documentation for the names of all valid keys.

Message #

A custom filter (%1) appears to have an invalid key. Keys can be any character on the system's keyboard or it's name. Please see documentation for the names of all valid keys.

Fields #

Name	Description
`Filter` UnicodeString

Event ID 10303: A custom filter (Filter) appears to be invalid.

Channel: Admin
Task: KeyboardFilterConfiguration

Description

A custom filter (Filter) appears to be invalid. A valid filter has zero or more modifiers, and a single key. Each modifier and key must be separated by (+).

Message #

A custom filter (%1) appears to be invalid.  A valid filter has zero or more modifiers, and a single key.  Each modifier and key must be separated by (+).

Fields #

Name	Description
`Filter` UnicodeString

Event ID 10304: Too many custom filters have been enabled.

Channel: Admin
Task: KeyboardFilterConfiguration

Description

Too many custom filters have been enabled. No more than Maximum custom and fixed filters may be defined.

Message #

Too many custom filters have been enabled.  No more than %1 custom and fixed filters may be defined.

Fields #

Name	Description
`Maximum` Int32

Event ID 11000: Hardware keyboard input

Channel: Performance
Task: Hardwarekeyboardinput
Opcode: Start

Event ID 11001: Hardware keyboard input

Channel: Performance
Task: Hardwarekeyboardinput
Opcode: Stop

Event ID 11002: Software keyboard input

Channel: Performance
Task: Softwarekeyboardinput
Opcode: Start

Event ID 11003: Software keyboard input

Channel: Performance
Task: Softwarekeyboardinput
Opcode: Stop

Event ID 11004: Load Configuration

Channel: Performance
Task: LoadConfiguration
Opcode: Start

Event ID 11005: Load Configuration

Channel: Performance
Task: LoadConfiguration
Opcode: Stop

Event ID 11006: Keybaord Layout Change

Channel: Performance
Task: KeybaordLayoutChange
Opcode: Start

Event ID 11007: Keybaord Layout Change

Channel: Performance
Task: KeybaordLayoutChange
Opcode: Stop

Event ID 11008: Desktop Change

Channel: Performance
Task: DesktopChange
Opcode: Start

Event ID 11009: Desktop Change

Channel: Performance
Task: DesktopChange
Opcode: Stop

Event ID 11010: User login

Channel: Performance
Task: Userlogin
Opcode: Start

Event ID 11011: User login

Channel: Performance
Task: Userlogin
Opcode: Stop

Event ID 11012: User logout

Channel: Performance
Task: Userlogout
Opcode: Start

Event ID 11013: User logout

Channel: Performance
Task: Userlogout
Opcode: Stop

Provenance

ETW provider GUID 84de80eb-86e8-4ff6-85a6-9319abd578a4

Defined in KeyboardFilterSvc.dll, which carries the event manifest.

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3037, captured 2026-06-02 — Manifest XML pack, 2.0 MB