Disable Internal Keyboard in Windows 11 via Group Policy

Disable Internal Keyboard in Windows 11 via Group Policy.md

Disable Internal Keyboard in Windows 11 via Group Policy

A clean, permanent method to disable the internal laptop keyboard using Windows Group Policy — tested on Asus ZenBook (ATK3001 ACPI device), but applicable to other laptops.

---

Requirements

• Windows 11 Pro, Enterprise, or Education — Home edition does not have gpedit.msc
• An external USB keyboard connected before you start — you will lose internal keyboard input
• Administrator account

To check your edition: Win + R → type winver → Enter

---

Step 1 — Identify Your Keyboard Device

Open Command Prompt and run:

pnputil /enum-devices /class Keyboard

Look for the entry under the Keyboards class that corresponds to your internal keyboard. On Asus laptops it typically looks like this:

Instance ID:       ACPI\ATK3001\4&1edebd7c&0
Device Description: PC/AT Enhanced PS/2 Keyboard (101/102-Key)

Then confirm the Hardware ID via Device Manager:

1. Open Device Manager (Win + X → Device Manager)
2. Expand Keyboards
3. Right-click your internal keyboard → Properties
4. Go to Details tab → set Property to Hardware Ids
5. Note the top value — e.g. ACPI\ATK3001

Hardware ID (ACPI\ATK3001) identifies the device type.
Instance ID (ACPI\ATK3001\4&1edebd7c&0) identifies this specific instance.
Group Policy uses the Hardware ID.

---

Step 2 — Open Group Policy Editor

Win + R → type gpedit.msc → Enter

---

Step 3 — Navigate to Device Installation Restrictions

In the left panel, expand:

Computer Configuration
  └─ Administrative Templates
       └─ System
            └─ Device Installation
                 └─ Device Installation Restrictions

---

Step 4 — Configure the Block Policy

In the right panel, double-click:

"Prevent installation of devices that match any of these device IDs"

1. Set to Enabled
2. Click Show... under Options
3. Enter your Hardware ID exactly:

   ACPI\ATK3001
   

4. Click OK to close the table
5. ✅ Check "Also apply to matching devices that are already installed"
   (Critical — without this, the policy only blocks future installs, not the currently running device)
6. Click Apply → OK

---

Step 5 — Uninstall the Device

Open CMD as Administrator and run:

pnputil /remove-device "ACPI\ATK3001\4&1edebd7c&0"

Or via Device Manager: right-click the internal keyboard → Uninstall device → confirm.

The internal keyboard stops working immediately.

---

Step 6 — Reboot and Verify

After reboot, Windows will attempt to reinstall the device but Group Policy will block it.

To verify: open Device Manager — the device will either be absent or show a yellow warning icon indicating blocked installation.

---

Reverting

1. Go back to the same Group Policy setting
2. Set it to Not Configured
3. Reboot — Windows reinstalls the driver automatically and the internal keyboard works again

---

Notes

• If you have an external USB keyboard also listed under Keyboards (e.g. HID\VID_...), this process does not affect it
• On Asus laptops, the ATK3001 device is part of the Asus ATK/ACPI package. Disabling it may also affect Fn key behavior or other Asus-specific hotkeys
• This method does not work on Windows 11 Home — use the registry ConfigFlags workaround instead

---

Quick Reference

Step	What you do
1	Find Hardware ID via Device Manager → Details → Hardware Ids
2	Open gpedit.msc
3	Navigate to Computer Config → Admin Templates → System → Device Installation → Device Installation Restrictions
4	Enable "Prevent installation of devices that match any of these device IDs", add your Hardware ID, check "also apply to already installed"
5	Run pnputil /remove-device "<Instance ID>" as Administrator
6	Reboot to confirm block is permanent