Windows appears to be recieving repeated keyboard shortcuts or unintended inputs across multiple applications.

VincentKC 0 Reputation points
2026-11-06T17:56:15.1466667+00:00

I'm troubleshooting a user whose Windows environment appears to be receiving repeated keyboard inputs without the user's interaction. The behavior appears across multiple applications and system windows:

  • Excel: Repeatedly triggers Undo until Excel reports that there is nothing left to undo
  • File Explorer/Save As dialogs: Address bar dropdown repeatedly gets selected, opens, and or cycles through entries, interfering with searches and saving files.
  • Services: When changing service's startup, dropdown continuously cycles through options like manual.
  • Also occurs in Settings and Device Manager.

I've already restarted Windows Explorer in Task Manager, the issue persisted after moving the user to a different laptop, user reports behavior occurring when connected to the same hub monitors. Monitor and laptop firmware and drivers have been updated.

How could Windows be receiving keyboard shortcuts or unintended HID input? What steps could be taken to identify the source of this issue? Are there Windows tools, logs, or diagnostic methods that could help? Since the issue persist across a different laptop, I'm interested in identifying a peripheral or maybe a USB connection.

Windows for home | Windows 11 | Devices and drivers
0 comments
Answer accepted by question author

AI answer

2026-11-06T17:57:25.8833333+00:00

Disconnect the hub/monitor USB data connection and reconnect only power and display; because the behavior follows the user to another laptop while the same hub/monitors remain connected, the shared USB/HID chain is the most discriminating place to isolate the source.

1. Isolate the shared peripheral chain

A monitor or dock can contain an internal USB hub and expose attached or built-in devices to Windows. Updating its firmware does not establish that those devices have stopped generating input.

  1. Disconnect from the laptop:
    • Dock or hub USB/USB-C/Thunderbolt cable.
    • Monitor USB upstream cables.
    • Wireless keyboard/mouse receivers.
    • External keyboards, mice, presentation controllers, keypads, headsets, and macro devices.
  2. Leave only laptop power and display connected. If USB-C carries both display and USB data, temporarily use a display-only connection or test without the external displays.
  3. Reproduce the issue using only the laptop’s built-in keyboard and touchpad.
  4. If it stops, reconnect one physical device or upstream USB cable at a time, waiting long enough to reproduce after each connection.
  5. When it returns, disconnect devices downstream of that hub one at a time. Also check monitor USB ports for receivers that may be easy to overlook.

Microsoft specifically recommends removing a USB hub and connecting a device directly to the PC when troubleshooting input devices.^1^

This A/B test is more useful than another laptop test: moving the same hub chain can move the offending HID device with the user.

2. Map the HID device to its physical USB port

On an affected laptop:

  1. Open Device Manager.
  2. Select View → Devices by connection.
  3. Expand the USB host controller/root-hub branches and locate the dock or monitor hub.
  4. Expand its children and look for:
    • HID Keyboard Device
    • HID-compliant consumer control device
    • HID-compliant vendor-defined device
    • Multiple keyboards or mice that appear only when the hub is attached
  5. Disconnect and reconnect one suspect device while watching which node disappears and returns.
  6. Open the device’s Properties → Details and record:
    • Device instance path
    • Hardware IDs
    • Location paths
    • Parent

A USB 3.x hub may appear as separate USB 2.0 and SuperSpeed hub branches, so inspect both branches.^2^ Device Manager can also show hidden devices, status, and problem codes.^3^

For a more explicit topology tree, install Debugging Tools for Windows from the Windows SDK and run usbview.exe. USBView displays controllers, hubs, attached devices, interfaces, and endpoint descriptors.^3^

3. Disable one suspect HID safely

After recording the device instance ID, test by disabling only that device. Do not disable the USB controller, root hub, or the only working keyboard/mouse.

From an elevated Command Prompt:

pnputil /enum-devices /connected /class Keyboard /deviceids
pnputil /enum-devices /connected /class HIDClass /deviceids
pnputil /enum-devices /instanceid "<device-instance-id>" /relations /stack
pnputil /disable-device "<device-instance-id>"
rem Reproduce the issue, then restore the device:
pnputil /enable-device "<device-instance-id>"

PnPUtil is included with Windows, can enumerate connected devices and their relationships, and supports disabling and re-enabling a specific device instance.^4^

Also check for installation problems:

pnputil /enum-devices /problem

This reports devices with PnP problem codes.^5^

4. Capture USB activity during the unwanted input

If physical isolation identifies a USB branch but not the exact device, capture a short USB ETW trace. Disconnect unrelated USB devices first and keep the capture narrowly bounded; ETL files can grow quickly.^6^

Run these commands from an elevated Command Prompt:

logman create trace -n usbtrace -o %SystemRoot%\Tracing\usbtrace.etl -nb 128 640 -bs 128
logman update trace -n usbtrace -p Microsoft-Windows-USB-USBXHCI (Default,PartialDataBusTrace)
logman update trace -n usbtrace -p Microsoft-Windows-USB-UCX (Default,PartialDataBusTrace)
logman update trace -n usbtrace -p Microsoft-Windows-USB-USBHUB3 (Default,PartialDataBusTrace)
logman update trace -n usbtrace -p Microsoft-Windows-USB-USBPORT
logman update trace -n usbtrace -p Microsoft-Windows-USB-USBHUB
logman update trace -n usbtrace -p Microsoft-Windows-Kernel-IoTrace 0 2
logman start -n usbtrace

Wait for the unwanted action, note its exact time, and stop immediately:

logman stop -n usbtrace
logman delete -n usbtrace
move /Y %SystemRoot%\Tracing\usbtrace_000001.etl %SystemRoot%\Tracing\usbtrace.etl

The resulting file is C:\Windows\Tracing\usbtrace.etl. USB ETW exposes hub additions/removals, port-state changes, endpoints, controller activity, and USB I/O useful for correlating the event with a device branch.^7^

5. If it continues with every external device disconnected

Perform a clean boot to distinguish a startup service or utility—such as keyboard remapping, macro, accessibility, remote-control, or vendor peripheral software—from the Windows input stack:

  1. Run msconfig.
  2. Services → Hide all Microsoft services → Disable all.
  3. Startup → Open Task Manager, then disable enabled startup apps.
  4. Restart and test.
  5. If the issue stops, re-enable half the services/items at a time until the responsible component is isolated.^8^

If it remains absent only when the hub or monitor USB path is disconnected, provide the isolated device instance ID, USB topology, reproduction timestamps, and ETL trace to the dock/monitor/peripheral manufacturer.

References

  1. Mouse and keyboard problems in Windows | Microsoft Support
  2. USB in Windows - FAQ
  3. Universal Serial Bus Viewer in Windows
  4. PnPUtil Command Syntax
  5. Troubleshooting Device and Driver Installations
  6. How to capture a USB event trace with Logman
  7. Overview of USB event tracing for Windows
  8. [Windows 11](https://support.microsoft.com/windows/experience/startup-boot/how-to-perform-a-clean-boot-in-windows)
AI-generated content may be incorrect. Read our transparency notes for more information.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.