fix(windows): set basekeyboard as current user not the admin user on a elevated process. by rc-swag · Pull Request #16162 · keymanapp/keyman

rc-swag · 2026-06-30T01:17:44Z

This was quicker fix then I thought the more through issue 15154 still remains to catch discover all the cases the non-admin user configuration changes that may been attempting.

Build-bot: release:windows

User Testing

TEST_BASE_KEYBOARD_CURRENT_USER

Login into Windows with and account that is a "standard" user and does not have "Administrator" rights.
Install the Keyman from this PR
Open Keyman Configuration -> Keyboard Layouts
Install a keyboard for example sil_ipa
Open Keyman Configuration -> Options

Check C:\ProgramData\Keyman\Keyman Engine\Keyboard\_Package\sil_ipa don't delete the base sil_ipa.kmx but delete any with KLIDs for example sil_ipa-00000409-d.kmx

Click Base Keyboard, change the Base Keyboard to German. You will need to enter the login details for a Admin user.
Confirm the Keyboard changes for the current user and not the Admin user used for the elevated processs.
Check C:\ProgramData\Keyman\Keyman Engine\Keyboard\_Package\sil_ipa there should now be a sil_ipa-????0407-d.kmx and sil_ipa-????0407.kmx

TEST_BASE_KEYBOARD_CURRENT_USER_KMX_EXISTS

After completing the steps in TEST_BASE_KEYBOARD_CURRENT_USER

Open Keyman Configuration -> Options
Click Base Keyboard, change the Base Keyboard to English. You may need to enter the login details for a Admin user.
Close Configuration
Check German mcomplied kmx is still there i.e. C:\ProgramData\Keyman\Keyman Engine\Keyboard\_Package\sil_ipa there should now be a sil_ipa-????0407-d.kmx and sil_ipa-????0407.kmx
Open Keyman Configuration -> Options
6.Click Base Keyboard, change the Base Keyboard to German. You should Not be asked to enter a admin user.

keymanapp-test-bot · 2026-06-30T01:17:51Z

User Test Results

Test specification and instructions

✅ TEST_BASE_KEYBOARD_CURRENT_USER (PASSED) (notes)
✅ TEST_BASE_KEYBOARD_CURRENT_USER_KMX_EXISTS (PASSED) (notes)

Test Artifacts

Windows

mcdurdin

I don't think this is correct. The base keyboard dialog needs to run elevated -- because when you change the base keyboard, Keyman needs to mcompile each of the installed keyboards against the new base keyboard:

keyman/windows/src/engine/kmcomapi/com/options/keymanoptions.pas

Lines 133 to 135 in 1536a5f

    
           if FOldBaseLayout <> Get_Items('koBaseLayout').Value then 
        
             for I := 0 to Context.Keyboards.Count - 1 do   // I4169 
        
               (Context.Keyboards.Items[I] as IIntKeymanKeyboardInstalled).UpdateBaseLayout;

The problem here is that the base layout setting is saved against the Admin user, but needs to be saved against the current user. This probably is best solved by splitting the admin component -- mcompiling -- out of the TKeymanOptions.Apply function, and running it as a separate step from the Base Keyboard dialog. Then the Base Keyboard dialog does not show elevated, but just elevates when OK is clicked, if it detects that new mcompiles need to be run, and does that as a kmshell -mcompile <basekeylayoutid> call? (implementation calls: TKeymanKeyboardInstalled.UpdateBaseLayout for each installed keyboard).

TKPRecompileMnemonicKeyboard then needs a parameter for the base layout, rather than reading it from the context options:

keyman/windows/src/engine/kmcomapi/processes/keyboard/kprecompilemnemonickeyboard.pas

Lines 87 to 88 in 9779792

    
           with Context as TKeymanContext do 
        
             BaseKeyboardID := (Options as IKeymanOptions).Items['koBaseLayout'].Value;

So some plumbing required, sadly.

rc-swag · 2026-07-06T02:06:20Z

I don't think this is correct. The base keyboard dialog needs to run elevated -- because when you change the base keyboard, Keyman needs to mcompile each of the installed keyboards against the new base keyboard:

This change may not have been the prefered change but it worked. It does run as an elevated but the process is created as a current user.
I tested it last week and it changed the base keyboard for the non admin user. Not the admin. I will look into it again.

mcdurdin · 2026-07-06T05:23:20Z

Did you verify that this worked with a baselayout you had never selected previously? How could the mcompiled .kmx files be written to the C:\ProgramData folder if the base layout steps are run non-elevated?

One reasonably straightforward way to address this, for starting as a non-elevated user:

CU: The Base Keyboard dialog itself should not be elevated - launch from the current process.
CU: After clicking OK, verify if any mcompile is needed by looking to see if the needed .kmx files are already present in ProgramData.
CU: If mcompile is required, then wait for elevated kmshell -mcompile <baseklid> should be called to run the mcompile process.
LM: kmshell -mcompile will need to temporarily set the option[koBaseLayout] for the admin user in order to run the process. This will cause mcompile to be run. Reset option afterwards.
CU: After the wait for elevated process step completes, set option[koBaseLayout] for current user.

Also:

If Keyman Configuration is started as an elevated user, skip steps 3 and 4.
Need to update kmcomapi to only run mcompile if elevated

mcdurdin · 2026-07-06T05:48:46Z

5. Confirm the Keyboard changes for the current user and not the Admin user used for the elevated processs

Need to verify that the relevant files are saved in ProgramData too and that the base keyboard is mapped as expected!

Meng-Heng · 2026-07-09T08:05:36Z

Test Prerequisites

Setup a non-admin local user by following this https://www.wikihow.com/Create-a-New-Local-User-Account-in-Windows-10

Test Specs

Windows 10 Bootcamp

Test Results

TEST_BASE_KEYBOARD_CURRENT_USER (PASSED):

Launch Keyman version 19.0.249
Open Keyman Configuration -> Options
Click Base Keyboard -> Enter Admin's password -> Change the Base Keyboard to English - Irish

Note

The Keyman Configuration window becomes unclickable until I click out of the app and click back. It does not show unresponding.

Confirmed: the Keyboard changes for the current user and not the Admin user.
To clarify, log into Admin account
Verified: The Base keyboard does not change to English - Irish.

Note

The 2nd and later attempts of changing the Base keyboard, this error pop up

The Base keyboard does not change until I click X, and then open Keyman again.

mcdurdin · 2026-07-09T08:48:33Z

The 2nd and later attempts of changing the Base keyboard, this error pop up

Note, if a crash dialog appears, FAIL the test. Also, please Copy to Clipboard and paste it into the test report.

TEST_BASE_KEYBOARD_CURRENT_USER (FAIL): a crash dialog appeared

The original change, changed the InKeymanKyboardInstalled UpdateBaseLayout inteface and it didn't need to. This change restores it.

rc-swag · 2026-08-04T05:31:36Z

Test-bot: retest TEST_BASE_KEYBOARD_CURRENT_USER

Meng-Heng · 2026-08-06T04:41:48Z

Test Specs

Keyman for Windows v19.9.260-alpha-test-16162
Windows 10 Bootcamp

Test Results

TEST_BASE_KEYBOARD_CURRENT_USER (PASSED):

Login into Windows with and account that is a "standard" user
Install the Keyman from this PR
Dialog pops up asking for the Admin Authentication
Open Keyman Configuration -> Keyboard Layouts
Install a sil_ipa keyboard
Open Keyman Configuration -> Options
Go to C:\ProgramData\Keyman\Keyman Engine\Keyboard\_Package\sil_ipa
Delete sil_ipa-00000409-d.kmx and sil_ipa-00000409.kmx both time asked for Admin login details
Click Base Keyboard -> change the Base Keyboard to German -> provide Admin login details
VERIFIED: the Keyboard changes for the current user and not the Admin user used for the elevated process
Check C:\ProgramData\Keyman\Keyman Engine\Keyboard\_Package\sil_ipa
VERIFIED: There are sil_ipa-00000407-d.kmx and sil_ipa-00000407.kmx` files.

TEST_BASE_KEYBOARD_CURRENT_USER_KMX_EXISTS (PASSED):

Continue after testing TEST_BASE_KEYBOARD_CURRENT_USER
Open Keyman Configuration -> Options
Click Base Keyboard -> change the Base Keyboard to English -> Enter login details for a Admin user
Check C:\ProgramData\Keyman\Keyman Engine\Keyboard\_Package\sil_ipa folder
VERIFIED: sil_ipa-00000407-d.kmx and sil_ipa-00000407.kmx are still in the folder
Return to Keyman Configuration -> Options
Click Base Keyboard -> change the Base Keyboard to German
VERIFIED: Changing the Base Keyboard back to German does not need to enter Admin details.

mcdurdin

This is heading definitely in the right direction. But I am uncomfortable with the hackery we are having to do in order to get mcompile to run when we want it to -- especially the awareness that kmshell now has to have of specific registry values owned by kmcomapi, which is something we want to avoid.

So I think I'd like to change the way that kmcom.Options.Apply works here, removing its side-effect call to recompile the base layouts.

Instead, let's add a new API endpoint to run mcompile, and then have that called by kmshell.MCompileBaseKeyboard. We can do that as an endpoint on kmcomapi.IKeymanKeyboardInstalled I think, so then kmshell.MCompileBaseKeyboard becomes responsible for iterating over the installed keyboards and calling IKeymanKeyboardInstalled.RecompileBaseLayout?

It's a whole lot more explicit and much less magical than my original design (which was informed by a fairly torrid period in Windows COM design where side-effects were commonplace, but which has not held up over time). It also clarifies the elevation boundary condition much more neatly.

We will need to documented in Keyman Engine for Windows as a BREAKING CHANGE but it's pretty minimal impact. (Will need to document the change in the API docs around the koBaseLayout option.)

Similarly, the keyboard install process should continue to have the call to recompile base layouts so kmshell will need to pass the base layout to the elevated call to install the keyboard also.

(If you haven't previously edited the COM API, I can walk you through it; there are a few stumbling points but it's not awful)

mcdurdin · 2026-08-11T06:06:06Z


-  if FOldBaseLayout <> Get_Items('koBaseLayout').Value then
+  FNewBaseLayout := Get_Items('koBaseLayout').Value;
+  if IsAdministrator and (FOldBaseLayout <> FNewBaseLayout) then


Why are we testing for IsAdministrator here?

mcdurdin · 2026-08-11T06:06:25Z

      if ki.MnemonicLayout then   // I4169
      begin
+        with Context as TKeymanContext do
+          BaseKeyboardID := (Options as IKeymanOptions).Items['koBaseLayout'].Value;


will this still get the admin value of base layout? do we need to be able to pass baselayout as a param to elevated kmshell?

mcdurdin · 2026-08-11T06:07:26Z

 begin
  if FRegKeyboard.MnemonicLayout and FileExists(FRegKeyboard.KeymanFile) then   // I4615
+  begin
+    BaseKeyboardID := (Context.Options as IKeymanOptions).Items['koBaseLayout'].Value;


ditto, this will still get admin's baselayout option value

mcdurdin · 2026-08-11T06:08:06Z

-begin
-  with TfrmBaseKeyboard.Create(nil) do
+function ConfigureBaseKeyboard(out BaseKeyboardID: Integer): Boolean;
+begin  with TfrmBaseKeyboard.Create(nil) do


Suggested change

begin with TfrmBaseKeyboard.Create(nil) do

begin

with TfrmBaseKeyboard.Create(nil) do

mcdurdin · 2026-08-11T06:09:12Z

+  if BaseKeyboardNeedsMCompile(BaseKeyboardID) and not kmcom.SystemInfo.IsAdministrator then
+      MCompileResult := WaitForElevatedConfiguration(WindowHandle, '-mcompile ' + IntToHex(BaseKeyboardID, 8)) = 0;


This means if isadmin then mcompile will never be called? Don't we need:

Suggested change

if BaseKeyboardNeedsMCompile(BaseKeyboardID) and not kmcom.SystemInfo.IsAdministrator then

MCompileResult := WaitForElevatedConfiguration(WindowHandle, '-mcompile ' + IntToHex(BaseKeyboardID, 8)) = 0;

if BaseKeyboardNeedsMCompile(BaseKeyboardID) then

begin

if not kmcom.SystemInfo.IsAdministrator then

MCompileResult := WaitForElevatedConfiguration(WindowHandle, '-mcompile ' + IntToHex(BaseKeyboardID, 8)) = 0;

else

MCompileResult := ... call directly?

end;

mcdurdin · 2026-08-11T06:10:14Z

+    // This is hacky, maybe just remove the registry value, however that
+    // would not force a recompile if the was the default base layout.
+    // Options.Apply re-compiles only when it observes a changed base layout.
+    // The caller may be repairing missing files for the already-selected layout.
+    Reg := TRegistryErrorControlled.Create;
+    try
+      if Reg.OpenKey(SRegKey_KeymanEngine_CU, True) then
+        Reg.WriteString(SRegValue_UnderlyingLayout, '00000000');
+    finally
+      Reg.Free;
+    end;


Not comfortable with this

mcdurdin · 2026-08-11T06:11:05Z

+  kmcom.Options['koBaseLayout'].Value := BaseKeyboardID;
+  try
+    if PreviousBaseKeyboardID = BaseKeyboardID then
+      ForceBaseLayoutChange;
+    kmcom.Options.Apply;
+    Result := True;
+  finally
+    kmcom.Options['koBaseLayout'].Value := PreviousBaseKeyboardID;
+    RestorePreviousBaseKeyboardValue;
+  end;


We can update the kmcom API and I think that might be better than side-effecting our way to a solution?

mcdurdin · 2026-08-13T06:43:54Z

  ModalResult := mrOk;
 end;

+function MCompileBaseKeyboard(const BaseKeyboardIDText: string): Boolean;


I think we should move this into its own unit

mcdurdin · 2026-08-13T13:23:26Z

Notes on COM API:

Establish a new interface in kmcomapi.ridl:

Forward declaration, Line 70 or close by:

interface IKeymanKeyboardInstalled2;

and declaration, define the interface (I generated a new GUID already: '{3086C85C-932A-4726-BF76-2D74DD133AC9}', can go near bottom of file:

  [
    uuid(3086C85C-932A-4726-BF76-2D74DD133AC9),
    version(19.0),
    helpstring("https://help.keyman.com/developer/engine/windows/19.0/api/IKeymanKeyboardInstalled2"),
    dual,
    oleautomation
  ]
  interface IKeymanKeyboardInstalled2: IKeymanKeyboardInstalled
  {
    [id(0x00000120)]
    HRESULT _stdcall SetBaseKeyboard(long KLID);
  };

Then in the implementation, we need in keymanapi_TLB.pas:

// *********************************************************************//
// Interface: IKeymanKeyboardInstalled2
// Flags:     (4416) Dual OleAutomation Dispatchable
// GUID:      {3086C85C-932A-4726-BF76-2D74DD133AC9}
// *********************************************************************//
  IKeymanKeyboardInstalled2 = interface(IKeymanKeyboardInstalled)
    ['{3086C85C-932A-4726-BF76-2D74DD133AC9}']
    procedure SetBaseKeyboard(KLID: Integer); safecall;
  end;

And finally, in keymankeyboardinstalled.pas:

  TKeymanKeyboardInstalled = class(   // I3581
    TKeymanKeyboard,
    IIntKeymanKeyboardInstalled,
    IKeymanKeyboardInstalled2)
  ...
  protected
    procedure SetBaseKeyboard(KLID: Integer); safecall;
  end;

and the implementation.

Details on names, etc, up to you, but suggest using IKeymanKeyboardInstalled2 to match patterns that we have elsewhere.

In usage in kmshell, you'll need to:

(kbd as IKeymanKeyboardInstalled2).SetBaseKeyboard(klid);

…oard-user-not-admin # Keyman Conventional Commit suggestions: # # - Link to a Sentry issue with git trailer: # Fixes: _MODULE_-_ID_ # - Give credit to co-authors: # Co-authored-by: _Name_ <_email_> # - Use imperative, present tense ('attach' not 'attaches', 'attached' etc) # - Don't include a period at the end of the title # - Always include a blank line before trailers # - More: https://github.com/keymanapp/keyman/wiki/Pull-Request-and-Commit-workflow-notes

rc-swag self-assigned this Jun 30, 2026

github-project-automation Bot moved this to Todo in Keyman Jun 30, 2026

github-project-automation Bot added this to Keyman Jun 30, 2026

keymanapp-test-bot Bot added the user-test-missing User tests have not yet been defined for the PR label Jun 30, 2026

keymanapp-test-bot Bot added this to the A19S32 milestone Jun 30, 2026

github-actions Bot added windows/ windows/config/ fix labels Jun 30, 2026

keymanapp-test-bot Bot added the has-user-test label Jun 30, 2026

mcdurdin requested changes Jun 30, 2026

View reviewed changes

keyman-server modified the milestones: A19S32, A19S33 Jul 4, 2026

keymanapp-test-bot Bot added user-test-required User tests have not been completed and removed user-test-missing User tests have not yet been defined for the PR labels Jul 6, 2026

Meng-Heng assigned Meng-Heng and unassigned Meng-Heng Jul 9, 2026

keymanapp-test-bot Bot removed the user-test-required User tests have not been completed label Jul 9, 2026

keymanapp-test-bot Bot added the user-test-failed label Jul 9, 2026

keyman-server modified the milestones: A19S33, A19S34 Jul 20, 2026

rc-swag closed this Jul 24, 2026

rc-swag force-pushed the fix/windows/15152/basekeyboard-user-not-admin branch from 2d6a4ee to 2c48025 Compare July 24, 2026 02:03

github-project-automation Bot moved this from Todo to Done in Keyman Jul 24, 2026

fix(windows): initial commit

65335ec

rc-swag reopened this Jul 24, 2026

github-project-automation Bot moved this from Done to In Progress in Keyman Jul 24, 2026

fix(windows): handle basekeyboard change non-admin user

92643e3

github-actions Bot added the windows/engine/ label Jul 29, 2026

fix(windows): restore UpdateBaseLayout interface

2f4c428

The original change, changed the InKeymanKyboardInstalled UpdateBaseLayout inteface and it didn't need to. This change restores it.

keyman-server modified the milestones: A19S34, A19S35 Aug 3, 2026

fix(windows): refresh UI after basekbd change

27970c6

keymanapp-test-bot Bot added the user-test-required User tests have not been completed label Aug 4, 2026

keymanapp-test-bot Bot removed the user-test-failed label Aug 4, 2026

keymanapp-test-bot Bot removed the user-test-required User tests have not been completed label Aug 6, 2026

rc-swag requested a review from mcdurdin August 12, 2026 06:06

mcdurdin requested changes Aug 13, 2026

View reviewed changes

mcdurdin mentioned this pull request Aug 13, 2026

bug(windows): automatic updates may not be able to find downloaded packages when admin user is not same as current user #16360

Open

keyman-server modified the milestones: A19S35, A19S36 Aug 17, 2026

rc-swag marked this pull request as draft August 18, 2026 06:06

	if FOldBaseLayout <> Get_Items('koBaseLayout').Value then
	for I := 0 to Context.Keyboards.Count - 1 do // I4169
	(Context.Keyboards.Items[I] as IIntKeymanKeyboardInstalled).UpdateBaseLayout;

	with Context as TKeymanContext do
	BaseKeyboardID := (Options as IKeymanOptions).Items['koBaseLayout'].Value;

	begin with TfrmBaseKeyboard.Create(nil) do
	begin
	with TfrmBaseKeyboard.Create(nil) do

		if BaseKeyboardNeedsMCompile(BaseKeyboardID) and not kmcom.SystemInfo.IsAdministrator then
		MCompileResult := WaitForElevatedConfiguration(WindowHandle, '-mcompile ' + IntToHex(BaseKeyboardID, 8)) = 0;

Uh oh!

Uh oh!

Conversation

rc-swag commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User Testing

TEST_BASE_KEYBOARD_CURRENT_USER

TEST_BASE_KEYBOARD_CURRENT_USER_KMX_EXISTS

Uh oh!

keymanapp-test-bot Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User Test Results

Test Artifacts

Uh oh!

mcdurdin left a comment

Choose a reason for hiding this comment

Uh oh!

rc-swag commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mcdurdin commented Jul 6, 2026

Uh oh!

mcdurdin commented Jul 6, 2026

Uh oh!

Meng-Heng commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Prerequisites

Test Specs

Test Results

Uh oh!

mcdurdin commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rc-swag commented Aug 4, 2026

Uh oh!

Meng-Heng commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Specs

Test Results

Uh oh!

mcdurdin left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mcdurdin commented Aug 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rc-swag commented Jun 30, 2026 •

edited

Loading

keymanapp-test-bot Bot commented Jun 30, 2026 •

edited

Loading

rc-swag commented Jul 6, 2026 •

edited

Loading

Meng-Heng commented Jul 9, 2026 •

edited

Loading

mcdurdin commented Jul 9, 2026 •

edited

Loading

Meng-Heng commented Aug 6, 2026 •

edited

Loading

mcdurdin left a comment •

edited

Loading