I give employees AES wireless keyboards. I would like to enforce the OS to only recognise the keyboard we supply. Is that possible? Assuming my employees OS are Windows 10, Ubuntu, Mac OSX.

How could it be done? I wasn't able to find how to enforce it just where to buy keyboard which is encrypted.

  • The keyboards are USB? You can restrict what USB devices are accepted. – schroeder Oct 16 '18 at 14:30
  • for windows, you could use WMI to iterate USB devices to find your keyboard(s). If you found one that wasn't authorized, you could probably disabled it with WMI, or at least shutdown the workstation. – dandavis Oct 16 '18 at 16:39
  • I'm voting to close. This seems both too broad and also not really security related. While it is certainly in the general ballpark, I feel like this would be a better fit on something like superuser.com. Keep in mind though that the answers will vary wildly for Windows, mac, and linux, so I doubt that asking about all three at once will get you anywhere on any site on the stackexchange network. – Conor Mancone Oct 16 '18 at 16:41
  • 1
    For this comment YMMV, but as a developer with strong opinions on keyboards, my answer (as an employee) would probably be "Find another job" :) Unless of course you had a clear and compelling reason why you wanted to require everyone to use encrypted wireless keyboards. Personally I'd prefer to just have a corded USB keyboard myself, which is probably more secure anyway... – Conor Mancone Oct 16 '18 at 16:43
  • 2
    Which, given my last comment (sorry for the long comment thread) makes me realize why I think this question is not a great fit here. You may be suffering from the X-Y problem. Rather than asking "how do I limit my employees to a specific keyboard" you are probably better off explaining the problem you are concerned about ("Can someone set up a bluetooth sniffer as a keylogger and capture all of my employee's passwords?") and letting everyone here help you figure out what your options are. – Conor Mancone Oct 16 '18 at 16:46


The short version is that you would want to install only the drivers you've approved. Then enable the following via Group Policy (or Local Group Policy). Your USB keyboard and USB mouse will adhere to this setting as will any USB device.

System\Device Installation\Device Installation Restrictions\ Prevent installation of removable devices

Description of this setting is as follows:

This policy setting allows you to prevent Windows from installing removable devices. A device is considered removable when the driver for the device to which it is connected indicates that the device is removable. For example, a Universal Serial Bus (USB) device is reported to be removable by the drivers for the USB hub to which the device is connected. This policy setting takes precedence over any other policy setting that allows Windows to install a device.

If you enable this policy setting, Windows is prevented from installing removable devices and existing removable devices cannot have their drivers updated. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of removable devices from a remote desktop client to the remote desktop server.

If you disable or do not configure this policy setting, Windows can install and update device drivers for removable devices as allowed or prevented by other policy settings.

For a far more detailed explanation, see Step-By-Step Guide to Controlling Device Installation Using Group Policy. While it was last updated in 2007, the information is still applicable.

Mac and Ubuntu

Super glue?

  • Ubuntu: You can use udev rules. – ThoriumBR Oct 16 '18 at 17:31
  • This isn't likely to be a very good solution. Many keyboards (most?) will not need to install a driver, as it will just expose itself to the OS as a HID class USB device. Also, you can do the same thing on Linux as Windows, still being equally ineffective, however. – forest Oct 16 '18 at 22:09
  • @forest, have a look at the referenced Step-By-Step guide. You'll see that one can get very specific by setting allowable device identification strings and/or setup classes. – user2320464 Oct 26 '18 at 15:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.