Multikey.sys Windows 11 May 2026

1. Executive Summary

multikey.sys is a kernel-mode driver file associated with MultiKeyboard, a utility developed by Oleg Kozlov (often distributed via ATNSOFT products like Key Remapper). Its primary function is to intercept and remap keyboard input at a low level, allowing multiple physical keyboards to be treated independently or to have customized key mappings per device.

On Windows 11, multikey.sys is not a native Microsoft driver. Its presence indicates third-party software installation. While functional, it raises significant compatibility, security, and stability concerns due to kernel-mode operation and the increasing security posture of Windows 11 (e.g., Hypervisor-Protected Code Integrity, Memory Integrity). multikey.sys windows 11

Step 2: Check for Persistence

Look for:

Scheduled tasks (Task Scheduler → check for random names).
Run/RunOnce registry keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run).

Registry entries:

HKLM\SYSTEM\CurrentControlSet\Services\MultiKeyboard
HKLM\SYSTEM\CurrentControlSet\Control\Class\4d36e96b-e325-11ce-bfc1-08002be10318\UpperFilters

(Note: presence in UpperFilters indicates it's active.) Step 2: Check for Persistence Look for:

Step 5: Disable Driver Signature Enforcement (Temporary - Not Recommended)

Only do this if you absolutely need to run an older legitimate device. Scheduled tasks (Task Scheduler → check for random names)

Hold Shift while clicking Restart.
Go to Troubleshoot > Advanced Options > Startup Settings.
Click Restart and press 7 or F7 for "Disable driver signature enforcement."
Warning: This weakens system security until you reboot again.