Windows 10: Setting lockscreen image for all users on a network after sysprep

Hi I used the sysprep tutorial to create an image for the classroom - during sysprep I created a users profile and locked all the personalization settings - in the system group policy I set a default lock screen image and set to not allow changes to the lock screen - I used the copy profile for my answer file - windows 10 pro 1607 image

This worked fine for the admin acount I created on initial setup however every new user account uses the slideshow and does not use the default image I setup - the image is stored in Windows/system32 folder

I have tried editing the registry HKEY Local Machine -> Software -> Polices -> Microsoft -> Windows -> Personalization -> LockScreenImage

to set the default image but this did not work.

Is there any way of setting the default lock screen for all users on the machine to use the image I setup

I also tried gpupdate /force I get the responce gpupdated but this does not fix the problem

Any suggestions, software, regedits, powershell scrupts I can use to force all users to have the same lock screen

thanks
Mike

:)

 

"defaultuser0" created on clean install of Anniversary Update

i also has the defaultuser0 in c:\users\. i am using the windows 10 1703 iso from VLSC and create golden image in VM and the golden image does not have defaultuser0 profile before i sysprep

after sysprep, and deploy in TS and login, i see defaultuser0 in c:\users\

 

Internet Explorer hangs running ActiveX scripting after sysprep

This solution worked for me:

• Don't use COPYPROFILE in unattend-XML answerfile
  
  Using COPYPROFILE causes the IE problem
• Delete all user accounts except Administrator before sysprep
  
  Otherwise sysprep may fail with errors saying "... application xy installed but not provisioned for all users ..." if any appx-update comes in while you are working on the image

After Startup and entering sysprep Audit-Mode,
immediately go to local user management and check, if account Administrator
is deactivated - if so, activate it.

Richard

 

Ok so after some searching I created the following PowerShell script to replace the default image for the login page - this works fine for a single user I thought by replacing the image in the Windows/web folder with my own any new users would have the same image but they get the standard image so I am stuck

Code: $code = @" using System; using System.Runtime.InteropServices; namespace CosmosKey.Utils { public class TokenManipulator { [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)] internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall, ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen); [DllImport("kernel32.dll", ExactSpelling = true)] internal static extern IntPtr GetCurrentProcess(); [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)] internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok); [DllImport("advapi32.dll", SetLastError = true)] internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid); [StructLayout(LayoutKind.Sequential, Pack = 1)] internal struct TokPriv1Luid { public int Count; public long Luid; public int Attr; } internal const int SE_PRIVILEGE_DISABLED = 0x00000000; internal const int SE_PRIVILEGE_ENABLED = 0x00000002; internal const int TOKEN_QUERY = 0x00000008; internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020; public const string SE_ASSIGNPRIMARYTOKEN_NAME = "SeAssignPrimaryTokenPrivilege"; public const string SE_AUDIT_NAME = "SeAuditPrivilege"; public const string SE_BACKUP_NAME = "SeBackupPrivilege"; public const string SE_CHANGE_NOTIFY_NAME = "SeChangeNotifyPrivilege"; public const string SE_CREATE_GLOBAL_NAME = "SeCreateGlobalPrivilege"; public const string SE_CREATE_PAGEFILE_NAME = "SeCreatePagefilePrivilege"; public const string SE_CREATE_PERMANENT_NAME = "SeCreatePermanentPrivilege"; public const string SE_CREATE_SYMBOLIC_LINK_NAME = "SeCreateSymbolicLinkPrivilege"; public const string SE_CREATE_TOKEN_NAME = "SeCreateTokenPrivilege"; public const string SE_DEBUG_NAME = "SeDebugPrivilege"; public const string SE_ENABLE_DELEGATION_NAME = "SeEnableDelegationPrivilege"; public const string SE_IMPERSONATE_NAME = "SeImpersonatePrivilege"; public const string SE_INC_BASE_PRIORITY_NAME = "SeIncreaseBasePriorityPrivilege"; public const string SE_INCREASE_QUOTA_NAME = "SeIncreaseQuotaPrivilege"; public const string SE_INC_WORKING_SET_NAME = "SeIncreaseWorkingSetPrivilege"; public const string SE_LOAD_DRIVER_NAME = "SeLoadDriverPrivilege"; public const string SE_LOCK_MEMORY_NAME = "SeLockMemoryPrivilege"; public const string SE_MACHINE_ACCOUNT_NAME = "SeMachineAccountPrivilege"; public const string SE_MANAGE_VOLUME_NAME = "SeManageVolumePrivilege"; public const string SE_PROF_SINGLE_PROCESS_NAME = "SeProfileSingleProcessPrivilege"; public const string SE_RELABEL_NAME = "SeRelabelPrivilege"; public const string SE_REMOTE_SHUTDOWN_NAME = "SeRemoteShutdownPrivilege"; public const string SE_RESTORE_NAME = "SeRestorePrivilege"; public const string SE_SECURITY_NAME = "SeSecurityPrivilege"; public const string SE_SHUTDOWN_NAME = "SeShutdownPrivilege"; public const string SE_SYNC_AGENT_NAME = "SeSyncAgentPrivilege"; public const string SE_SYSTEM_ENVIRONMENT_NAME = "SeSystemEnvironmentPrivilege"; public const string SE_SYSTEM_PROFILE_NAME = "SeSystemProfilePrivilege"; public const string SE_SYSTEMTIME_NAME = "SeSystemtimePrivilege"; public const string SE_TAKE_OWNERSHIP_NAME = "SeTakeOwnershipPrivilege"; public const string SE_TCB_NAME = "SeTcbPrivilege"; public const string SE_TIME_ZONE_NAME = "SeTimeZonePrivilege"; public const string SE_TRUSTED_CREDMAN_ACCESS_NAME = "SeTrustedCredManAccessPrivilege"; public const string SE_UNDOCK_NAME = "SeUndockPrivilege"; public const string SE_UNSOLICITED_INPUT_NAME = "SeUnsolicitedInputPrivilege"; public static bool AddPrivilege(string privilege) { try { bool retVal; TokPriv1Luid tp; IntPtr hproc = GetCurrentProcess(); IntPtr htok = IntPtr.Zero; retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok); tp.Count = 1; tp.Luid = 0; tp.Attr = SE_PRIVILEGE_ENABLED; retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid); retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero); return retVal; } catch (Exception ex) { throw ex; } } public static bool RemovePrivilege(string privilege) { try { bool retVal; TokPriv1Luid tp; IntPtr hproc = GetCurrentProcess(); IntPtr htok = IntPtr.Zero; retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok); tp.Count = 1; tp.Luid = 0; tp.Attr = SE_PRIVILEGE_DISABLED; retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid); retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero); return retVal; } catch (Exception ex) { throw ex; } } } } "@ # Take ownership add-type $code [void][CosmosKey.Utils.TokenManipulator]::AddPrivilege([CosmosKey.Utils.TokenManipulator]::SE_RESTORE_NAME) $file = "c:\Windows\Web\Screen\img100.jpg" $user = $env:username $Account = New-Object System.Security.Principal.NTAccount($user) $FileSecurity = new-object System.Security.AccessControl.FileSecurity $FileSecurity.SetOwner($Account) [System.IO.File]::SetAccessControl($file, $FileSecurity) [void][CosmosKey.Utils.TokenManipulator]::RemovePrivilege([CosmosKey.Utils.TokenManipulator]::SE_RESTORE_NAME) # copy file permissions $Acl = Get-Acl "C:\Users\Test" Set-Acl "C:\Windows\Web\Screen\img100.jpg" $Acl Unblock-File -Path "C:\Windows\Web\Screen\img100.jpg" # Replace image file Get-Item -Path C:\screen\img100.jpg Copy-Item -Path C:\screen\img100.jpg -Destination C:\Windows\Web\Screen -Recurse -force # Set registry key $path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" $img = "C:\Windows\System32\screen.jpg" Set-ItemProperty -Path $path -Name LockScreenImage -value $img[/quote]