Microsoft-Windows-KeyboardFilter
56 events across 3 channels
Event ID 10001: The Keyboard Filter Service was unable to obtain the session token from the session id: Message (ErrorCode).
#Description
The Keyboard Filter Service was unable to obtain the session token from the session id: Message (ErrorCode). Please verify that Terminal Services client is installed and the service is running under the LocalSystem user.
Message #
Fields #
| Name | Description |
|---|---|
Message UnicodeString | |
ErrorCode UInt32 |
Event ID 10002: The Keyboard Filter Service was unable to obtain access to Terminal Services: Message (ErrorCode).
#Event ID 10003: Could not obtain a lock on local policy settings for update detection, Message (ErrorCode).
#Event ID 10004: Could not update keyboard filter subsystem, Message (ErrorCode).
#Event ID 10005: The Keyboard Filter Service could not start session monitor.
#Description
The Keyboard Filter Service could not start session monitor. The session monitor ensures keyboard layout changes are reflected within the service and that on-screen keyboards work correctly. Check to make sure system permissions are set up correctly. Reason, Message (ErrorCode).
Message #
Fields #
| Name | Description |
|---|---|
Message UnicodeString | |
ErrorCode UInt32 |
Event ID 10006: Session Manager handle to Keyboard Filter process was abandoned.
#Description
Session Manager handle to Keyboard Filter process was abandoned. Handle will be removed from the session list.
Message #
Event ID 10007: The Keyboard Filter Service failed to launch hook process.
#Event ID 10008: 'sdbinst -q (SdbPath)' has probably failed, exit code of (ExitCode).
#Event ID 10009: Unsupported.
#Description
Unsupported (e.g. remote) session was disconnected by Keyboard Filter Service.
Message #
Event ID 10010: Keyboard Filter Driver could not start and has unloaded.
#Event ID 10011: The Keyboard Filter Driver could not attach to keyboard.
#Event ID 10012: The Keyboard Filter Driver could not properly filter keystroke information.
#Event ID 10013: The Keyboard Filter Driver could not update filter configuration.
#Event ID 10014: A non-empty list of keyboard filter rules resulted in an empty scancode list.
#Description
A non-empty list of keyboard filter rules resulted in an empty scancode list.
Message #
Event ID 10015: Error was returned when trying to transform a keyboard filter rule to a scancode.
#Event ID 10016: Attempting to launch the keyboard filter hook process.
#Description
Attempting to launch the keyboard filter hook process.
Message #
Event ID 10050: Failed to attach session Message (ErrorCode).
#Event ID 10051: Failed to detach session Message (ErrorCode).
#Event ID 10053: IOCTLReadBreakoutKeyFailed Message (ErrorCode).
#Event ID 10054: CreateResources failed Message (ErrorCode).
#Event ID 10055: RPC initialization failed Message (ErrorCode).
#Event ID 10056: BreakoutKey thread launch failure Message (ErrorCode).
#Event ID 10057: Run failed while waiting on handles Message (ErrorCode).
#Event ID 10058: Set KeyboardLayout failed Message (ErrorCode).
#Event ID 10059: RegisterDeviceNotification failed Message (ErrorCode).
#Event ID 10101: The Keyboard Filter Service has Started
#Description
The Keyboard Filter Service has Started.
Message #
Event ID 10102: The Keyboard Filter Service has stopped
#Description
The Keyboard Filter Service has stopped.
Message #
Event ID 10103: Generic Keyboard Filter Service message: Generic_Keyboard_Filter_Service_message.
#Event ID 10104: 'sdbinst -q (SdbPath)' executed, exit code (ExitCode).
#Event ID 10201: Administrator user UserName is now logged on, keyboard filtering is disabled for this session.
#Event ID 10202: User UserName logged off.
#Event ID 10203: User UserName logged off.
#Event ID 10204: User UserName is now logged on.
#Event ID 10205: The Keyboard Filter Service has detected Policy changes and is reloading them
#Description
The Keyboard Filter Service has detected Policy changes and is reloading them.
Message #
Event ID 10206: The Keyboard Filter Service has detected a layout change to Layout.
#Event ID 10207: The Keyboard Filter Service has found the following enabled policies.
#Event ID 10208: The Keyboard Filter Service is sending scancodes to the Filter Driver.
#Event ID 10301: A custom filter appears to have an invalid modifier (system) key.
#Event ID 10302: A custom filter (Filter) appears to have an invalid key.
#Event ID 10303: A custom filter (Filter) appears to be invalid.
#Event ID 10304: Too many custom filters have been enabled.
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID 84de80eb-86e8-4ff6-85a6-9319abd578a4
Defined in KeyboardFilterSvc.dll, which carries the event manifest.
Observed on:
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3037, captured 2026-06-02