I can confirm nLite is using the Scan Code Map approach to disable the win keys. Strangely, I thought the tool remapkey can tell me if there's any keys are being remapped or removed but in this case it tells nothing. Thanks!
I installed a Windows Server 2003 which is created using nLite with option "Disable Windows Keys" checked in the "Tweaks" part. The problem is that I wanted to restore the functionality of the Windows key after installing but don't know what's the registry or policy that nLite has made the change. Thanks