Push setting to client from WDM with auto disable/enable write filter

Our Wyse D90D7 are protected with write filter on, clients are booting to a webpage that connects to our Citrix Farm. We recently noticed that people cannot use control tab, this activated the Windows Embedded layer instead of ctrl tab on the Citrix farm.

Any tips on how to solve this? also is it save to set the write filter on disabled als default, this make it easier to manage the clients if needed.