locked
April 2018 Windows Updates to Server 2016 breaks "Force a specific default lock screen image" (LockScreenImage) Group Policy RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Background

    I copy a picture file to the C: and use GPO to force the picture file as the lock screen image.  I've been doing this for years, on several different versions/editions of Windows, and it works well.

    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" -Name "LockScreenImage" -Value "C:\Windows\LockScreen.jpg" -Type String

    This corresponds to policy: Computer Configuration > Administrative Templates > Control Panel > Personalization > Force a specific default lock screen image.

    Problem

    One of the April 2018 Windows Updates (I don't know which one exactly) breaks this policy for Windows Server 2016.  There are two configuration possibilities:

    1. The server is newly deployed, and the April 2018 updates are installed before the policy is applied.
    2. The server is pre-existing, and the policy is applied/active prior to the April 2018 updates being installed.

    Results:

    1. No image is displayed, and the default blue background is what you see.
    2. The lockscreen image is still displayed because the image is cached in the "$env:ALLUSERSPROFILE\Microsoft\Windows\SystemData" folder.  However the cache is never updated.  So, if you update the picture file specified in the policy, the lockscreen image will never change.  Also, if you delete the cached images, no picture is displayed (just like result #1).

    Steps to reproduce:

    1. Install two, fresh instances of Windows Server 2016.
    2. On instance #1, install all available Windows Updates, except anything newer than March 2018.
    3. On instance #2, install all available Windows Updates.
    4. On both servers, use gpedit.msc to enable the "force a lock screen image" policy.
    5. Reboot the servers.
    6. Instance #1 will display the configured lock screen image.  Instance #2 will show the default blue lock screen.

    Notes

    • This problem occurs regardless of how the policy is enabled (gpedit.msc, Domain Group Policy, or simply setting the registry key).
    • RSoP shows the policy applied, and the registry value is in the registry.
    • You can use WSUS to limit which updates are presented to the servers.  This is what I did for testing.

    Any help would be appreciated.  Thank you.

    -Tony

    Thursday, April 19, 2018 3:41 AM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

     

    This is a quick note to let you know that I am currently performing research on this issue and will get back to you as soon as possible. I appreciate your patience.

    If you have any updates during this process, please feel free to let me know.

    Best Regards,

    William

    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, April 23, 2018 1:08 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    ... I appreciate your patience. If you have any updates during this process, please feel free to let me know ...

    Thank you for looking into this.

    I discovered that the bug prevents the wallpaper file from appearing in its necessary location. So, I have a workaround (the file must be called lockscreen.jpg):

    New-Item -Path "$env:ALLUSERSPROFILE\Microsoft\Windows\SystemData\S-1-5-18\ReadOnly\LockScreen_P" -ItemType Directory -ErrorAction Ignore
Copy-Item -Path "C:\Windows\LockScreen.jpg" -Destination "$env:ALLUSERSPROFILE\Microsoft\Windows\SystemData\S-1-5-18\ReadOnly\LockScreen_P\" -Force -ErrorAction Ignore

    This is not a good workaround for these reasons:

    • The destination location only allows System and TrustedInstaller access permission.  So, I must modify the default permissions on this Windows' internal-use directory. This is not good practice.
    • Someone at Microsoft agrees with me because Windows resets the permissions back to defaults on every reboot.
    • On a working computer (pre-Apr18 updates), the file size of the lockscreen.jpg file in the Lockscreen_P directory is much smaller than the original.  My workaround does not reproduce whatever processing Windows does to the file making it smaller.

    To be honest, I'm not looking for a workaround.  I'm hoping you can reproduce the bug and get it properly reported so it can be fixed.

    -Tony

    Tuesday, April 24, 2018 2:06 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    I would apologize for the delayed reply.

    First, thanks for sharing the workaround in our forum. It would be helpful to anyone who encounters similar issue.

    Based on my research and test, I got the same result in my lab, we will report the issue to related departments through our channel, this may need sometimes delay.

    If there is anything else we can do for you, please feel free to post in the forum.

    Best Regards,

    William

    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, April 27, 2018 9:41 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    I´m having the same problems on a LTSB version, always after April updates. The only way I have found to "repair" it, is disabling the "Avoid user from changing lock screen" GPO. In this way, the personalized image for lock screen appears agains.

    The problem is that I can't leave like this, I need the user not to change the corporate image.

    I hope Microsoft repairs this bugs soon...

    Thanks!

    Bye

    Miguel Angel Aguirre

    Tuesday, May 29, 2018 7:48 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Probably the same problem as on Windows 10 1803.
    Thursday, June 7, 2018 10:08 AM