Using the Keyboard Filter with Applocker

Question

Using the Keyboard Filter with Applocker

Christian Reynolds 0

Hi, I am working on an Applocker configuration for a Windows 11 IoT Enterprise device and I'm struggling with using the KeyboardFilter and Applocker together. When I am running the system without Applocker, the KeyboardFilter properly filters out the sequences I've specified, however when I enable Applocker, it doesn't prevent these sequences anymore. In Event Viewer, there is a warning that "The Keyboard Filter Service failed to launch hook process. Reason: This program is blocked by group policy. For more information, contact your system administrator." for the User SYSTEM. That is followed by a "Failed to detach session Catastrophic failure" Error. Any configuration I've tried other than just allowing all executables for all users causes this issue with the KeyboardFilter. Is there a way to see a list of what this requires to function or can someone assist me? It's not very verbose about what's actually causing this issue.

Ideally I would like to use these configurations but the error shows up here as well: https://github.com/nsacyber/AppLocker-Guidance/blob/master/AppLocker%20Starter%20Policy/Windows11_AppLocker%20Starter%20Policy.xml

Sean Liming 4,776 Reputation points Volunteer Moderator

2025-07-24T16:31:48.82+00:00

Rather than using Applocker, why not use Windows Defender Application Control (WDAC) now known as Application Control?

1 answer

Your answer

Sean Liming 4,776 Reputation points Volunteer Moderator

2025-07-24T16:31:48.82+00:00

Rather than using Applocker, why not use Windows Defender Application Control (WDAC) now known as Application Control?

Answer 1

Dear Christian,

To resolve the issue with the Keyboard Filter not functioning properly when AppLocker is enabled, the root cause is likely that AppLocker is blocking essential executables required by the Keyboard Filter service.

Here’s how to fix it:

Review AppLocker Logs

Use Event Viewer to identify which executable is being blocked (typically the error will reference the Keyboard Filter hook process).

Check AppLocker logs under Applications and Services Logs > Microsoft > Windows > AppLocker.

Create Explicit AppLocker Rules

Allow Required Executables: Add rules to allow KeyboardFilterService.exe and any supporting processes or DLLs it needs.

System Services & Group Policy: Ensure system-related paths (e.g., C:\Windows\System32) aren't blocked by restrictive rules.

Use Publisher or Path rules to whitelist trusted components.

Verify Group Policy Settings

Open Group Policy Management Editor.

Navigate to:

Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker

Make sure no policies are unintentionally preventing system services like Keyboard Filter from launching.

Test with Relaxed Rules

As a diagnostic step, configure AppLocker to allow all executables temporarily.

Confirm that the Keyboard Filter functions correctly.

Then, tighten the policy step-by-step to isolate the exact rule needed without compromising overall security.

By explicitly allowing the necessary executables and ensuring your policy isn't overly restrictive, you should be able to run Keyboard Filter and AppLocker together without conflict.

Let me know if you need help identifying the specific blocked executable from your logs.

Best regards,Dear Christian,

To resolve the issue with the Keyboard Filter not functioning properly when AppLocker is enabled, the root cause is likely that AppLocker is blocking essential executables required by the Keyboard Filter service.

Here’s how to fix it:

1. Review AppLocker Logs

Use Event Viewer to identify which executable is being blocked (typically the error will reference the Keyboard Filter hook process).

Check AppLocker logs under Applications and Services Logs > Microsoft > Windows > AppLocker.

2. Create Explicit AppLocker Rules

Allow Required Executables: Add rules to allow KeyboardFilterService.exe and any supporting processes or DLLs it needs.

System Services & Group Policy: Ensure system-related paths (e.g., C:\Windows\System32) aren't blocked by restrictive rules.

Use Publisher or Path rules to whitelist trusted components.

3. Verify Group Policy Settings

Open Group Policy Management Editor.

Navigate to:

Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker

Make sure no policies are unintentionally preventing system services like Keyboard Filter from launching.

4. Test with Relaxed Rules

As a diagnostic step, configure AppLocker to allow all executables temporarily.

Confirm that the Keyboard Filter functions correctly.

Then, tighten the policy step-by-step to isolate the exact rule needed without compromising overall security.

By explicitly allowing the necessary executables and ensuring your policy isn't overly restrictive, you should be able to run Keyboard Filter and AppLocker together without conflict.

Let me know if you need help identifying the specific blocked executable from your logs.

Best regards,

Christian Reynolds 0 Reputation points

2025-07-23T19:11:16.72+00:00

From my testing, the Keyboard Filter seems to access some executable(s) in both of these paths:

<FilePathCondition Path="C:\Windows\UUS\*" />

<FilePathCondition Path="C:\Windows\WinSxS\*" />

So it functions properly when both are allowed. I was more interested in seeing if there are maybe known executables within these that the Keyboard Filter needs to function, as AppLocker doesn't include any errors/warnings when the Keyboard Filter is failing that point me to the issue. Opening these up is a security risk and I do not have the ability to search the almost 14,000 folders in WinSxS that may expose me to LOTL attacks.

Share via

Using the Keyboard Filter with Applocker

1 answer

Your answer