Microsoft-Windows-KeyboardFilter
56 events across 3 channels
Event ID 10001 — The Keyboard Filter Service was unable to obtain the session token from the session id: Message (ErrorCode).
Event ID 10002 — The Keyboard Filter Service was unable to obtain access to Terminal Services: Message (ErrorCode).
Event ID 10003 — Could not obtain a lock on local policy settings for update detection, Message (ErrorCode).
Event ID 10004 — Could not update keyboard filter subsystem, Message (ErrorCode).
Event ID 10005 — The Keyboard Filter Service could not start session monitor.
Event ID 10006 — Session Manager handle to Keyboard Filter process was abandoned.
Description
Session Manager handle to Keyboard Filter process was abandoned. Handle will be removed from the session list.
Message #
Event ID 10007 — The Keyboard Filter Service failed to launch hook process.
Event ID 10008 — 'sdbinst -q (SdbPath)' has probably failed, exit code of (ExitCode).
Event ID 10009 — Unsupported.
Description
Unsupported (e.g. remote) session was disconnected by Keyboard Filter Service.
Message #
Event ID 10010 — Keyboard Filter Driver could not start and has unloaded.
Event ID 10011 — The Keyboard Filter Driver could not attach to keyboard.
Event ID 10012 — The Keyboard Filter Driver could not properly filter keystroke information.
Event ID 10013 — The Keyboard Filter Driver could not update filter configuration.
Event ID 10014 — A non-empty list of keyboard filter rules resulted in an empty scancode list.
Description
A non-empty list of keyboard filter rules resulted in an empty scancode list.
Message #
Event ID 10015 — Error was returned when trying to transform a keyboard filter rule to a scancode.
Event ID 10016 — Attempting to launch the keyboard filter hook process.
Description
Attempting to launch the keyboard filter hook process.
Message #
Event ID 10050 — Failed to attach session Message (ErrorCode).
Event ID 10051 — Failed to detach session Message (ErrorCode).
Event ID 10052 — Missing Breakout keycode
Description
Missing Breakout keycode.
Message #
Event ID 10053 — IOCTLReadBreakoutKeyFailed Message (ErrorCode).
Event ID 10054 — CreateResources failed Message (ErrorCode).
Event ID 10055 — RPC initialization failed Message (ErrorCode).
Event ID 10056 — BreakoutKey thread launch failure Message (ErrorCode).
Event ID 10057 — Run failed while waiting on handles Message (ErrorCode).
Event ID 10058 — Set KeyboardLayout failed Message (ErrorCode).
Event ID 10059 — RegisterDeviceNotification failed Message (ErrorCode).
Event ID 10101 — The Keyboard Filter Service has Started
Description
The Keyboard Filter Service has Started.
Message #
Event ID 10102 — The Keyboard Filter Service has stopped
Description
The Keyboard Filter Service has stopped.
Message #
Event ID 10103 — Generic Keyboard Filter Service message: Generic_Keyboard_Filter_Service_message.
Event ID 10104 — 'sdbinst -q (SdbPath)' executed, exit code (ExitCode).
Event ID 10201 — Administrator user UserName is now logged on, keyboard filtering is disabled for this session.
Event ID 10202 — User UserName logged off.
Event ID 10203 — User UserName logged off.
Event ID 10204 — User UserName is now logged on.
Event ID 10205 — The Keyboard Filter Service has detected Policy changes and is reloading them
Description
The Keyboard Filter Service has detected Policy changes and is reloading them.
Message #
Event ID 10206 — The Keyboard Filter Service has detected a layout change to Layout.
Event ID 10207 — The Keyboard Filter Service has found the following enabled policies.
Event ID 10208 — The Keyboard Filter Service is sending scancodes to the Filter Driver.
Event ID 10301 — A custom filter appears to have an invalid modifier (system) key.
Event ID 10302 — A custom filter (Filter) appears to have an invalid key.
Event ID 10303 — A custom filter (Filter) appears to be invalid.
Event ID 10304 — Too many custom filters have been enabled.
Event ID 11000 — Hardware keyboard input
Description
Hardware keyboard input.
Message #
Event ID 11001 — Hardware keyboard input
Description
Hardware keyboard input.
Message #
Event ID 11002 — Software keyboard input
Description
Software keyboard input.
Message #
Event ID 11003 — Software keyboard input
Description
Software keyboard input.
Message #
Event ID 11004 — Load Configuration
Description
Load Configuration.
Message #
Event ID 11005 — Load Configuration
Description
Load Configuration.
Message #
Event ID 11006 — Keybaord Layout Change
Description
Keybaord Layout Change.
Message #
Event ID 11007 — Keybaord Layout Change
Description
Keybaord Layout Change.
Message #
Event ID 11008 — Desktop Change
Description
Desktop Change.
Message #
Event ID 11009 — Desktop Change
Description
Desktop Change.
Message #
Event ID 11010 — User login
Description
User login.
Message #
Event ID 11011 — User login
Description
User login.
Message #
Event ID 11012 — User logout
Description
User logout.
Message #
Event ID 11013 — User logout
Description
User logout.