Group Policy Central

Since I posted my Best Practice: Using Group Policy to configure Desktop Wallpaper (“Background”) a few of you have asked for me to do a post showing how to configure the Windows 7 Logon UI Background wallpaper. So below I have outlined the steps (with tips) showing you how to deploy and enabled a Logon UI background wallpaper to your fleet of Windows 7 computers.

Unlike the normal Background option the Logon UI Background is only show when the computer is not logged on or when it is locked. While I know some of you might loath having to set a wallpaper for your users computers as like myself you like to have the freedom to change this setting. This may be a much nicer balance for your user and management as you can still have your corporate branding applied to your computers but still allow the users to have their own custom background image when they are logged on.

Tip #1: Before you you start I would check out the WithinWindows article that goes into more details on how this option is configured at WithInWindows: Windows 7 to officially support logon ui background customization .

Essential we have to do three things; 1. create a local the folder for the background image; 2. copy the background image to the local folder and; 3. enable the registry key to show the background image.

Step 1. Edit a Group Policy Object that is applied to the machines that you want to make this change on. Then use the Folders Extension to create the path “%WindowsDir%\System32\oobe\info\backgrounds”.

Explanation: This is done to create the folders that we will place the Login background image as this is normally not created OOB.

Note: That even thought the “Info” folder is not explicitly created the fact that it is part of the path it will also implicitly be created.

Step 2. In the same Group Policy Object use the File Extension to copy a background image (e.g. backgroundDefault.jpg) to the path that was created above.

Note: In this example the source was “\\demodc01\Wallpaper\backgroundDefault.jpg” and the destination was “%WindowsDir%\System32\oobe\info\backgrounds\backgroundDefault.jpg”

Tip #2: As this policy is being run under the contest of the local System account you will need to make sure the location on the network where the file is being copied from has read access for the Domain Computers group.

Now we need to enable the “OEMBackground” registry key so that windows will use the wallpaper file we just copied over the to the computer (see details below).

OEMBackground

Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background
Value: OEMBackground (REG_DWORD32)
Data: 0 (Standard Wallpaper only, Default)
Data: 1 (Custom Logon UI wallpaper enabled if possible)

Step 3: Again, in the same GPO we need to enable the Logon UI Wallpaper and create a new Registry Extension item.

Step 4 (Optional): Configured the Description.

Tip #3: This is not required but is always a good idea so that someone else looking at this policy can figured out what the policy does.

Tip #4: As this registry key already exists then I would NOT recommend using the

Done. Now when the user logs off or shutdown the computer they will have the new background image (see below).

What I really like about this method as opposed to doing it via a logon script is that the affect is immediate and if the user finds and changes the background image it will be reset back at the next policy refresh. This also means you can push out a new background image on a regular basis as all you have to do it update the source background image on the network and it will automatically propagate from there…

Tip #5: If the background image is not working then make sure the file is less that 250kb in size as this is a built in restriction presumably to prevent slow down in loading very large image files. To resize the image I use Paint .Net which is a free image editing app that allows you to configure the compression ratio on JPG files.

Tip #6: Remember that if you use only the “backgroundDefault.jpg” file then it will stretch and skew the photo to fit the resolution of the screen. See the WithInWindows article for the other files names that are used for specific screen resolutions/ratios.

Group Policy is of course one of the best ways you can lockdown and configure your windows systems in your environment and one of the most commonly configured setting in Group Policy is the ability to configured the Desktop Wallpaper (a.k.a. Background) image. Now most of you might just say is all you need to do is set the  group policy setting however there are some common traps that you might fall into if you don’t use this setting correctly.

Method #1: Administrative Template “Desktop Wallpaper” Setting

The “Desktop Wallpaper” method is of course the most commonly used way for configuring the Wallpaper on a computer however as it seems with all things Group Policy using this setting comes with its own pro’s and con’s.

Pro’s

• Change is Restricted for the users
• Works on all versions of Windows

Con’s

• Limited targeting only based on standard Group Policy Object’s (OU,Security Filter,Site,WMI & Domain)

This setting can be found under User Configuration > Administrative Templates > Desktop > Desktop and is straight forward to configure as all you have to do is specify the explicit local path or a UNC to the image you want displayed as the desktop wallpaper (see below).

Behind the scenes all this setting is doing is configuring the REG_SZ “Wallpaper” and the REG_SZ “WallpaperStyle”  registry keys under the HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System  path.

TIP #1: If you are running Windows 7/Server 2008 R2 pre-Service Pack 1 you will need to install hotfix http://support.microsoft.com/kb/977944 for this setting to work.

TIP #2: If you are configuring this setting I recommend that you use the “Fill” Wallpaper Style as this will work best with most screen resolutions (especially on Windows 7).

TIP #3: If you configure this setting you will need to wait for the user to logoff the computer before the background is updated.

Method #2: Group Policy Preferences Registry Key Wallpaper Configuration

As I mention in Method #1 all the Administrative Template “Desktop Wallpaper” does is configure the HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System REG_SZ “Wallpaper” key. Therefore you can also use the Group Policy Preference Registry Extension option to also set the same key to give you some added benefits.

Pro’s

• Support advanced targeting option due to Group Policy Preferences Item-Level Targeting
• Change is Restricted or Unrestricted for the user

Con’s

• Must run Windows XP (or greater)
• Must have the Group Policy Client Side Extensions installed.

To configured the Desktop Wallpaper the same as the “Desktop Wallpaper” administrative template simply create two registry keys User Configuration > Preferences > Windows Settings > Registry (see below). Now depending on the registry key that you configure for this setting you can either have this as a restricted (a.k.a. locked) setting or an unrestricted setting that allows the users to make their own changes.

Restricted: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper

Unrestricted: HKCU\Control Panel\Desktop\Wallpaper

Restricted: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\WallpaperStyle

Unrestricted: HKCU\Control Panel\Desktop\WallpaperStyle

Tip #4: If you don’t configured the “WallpaperStyle” registry key then users will still be able to choose their own Wallpaper Style.

If you chose the restricted registry keys to configured the wallpaper then ensure you also select the “Replace” action and “Remove this item when it is no longer applied” common option is selected (see below). If you don’t do this you will find that your users will not be able to change their wallpaper even after the policy is removed as the policy registry key will not be removed.

If you chose to use the unrestricted registry key values then also make sure you chose the “Apply once and do not reapply” option. If you don’t do this the users wallpaper will be reset ever time they log off their computer as the key will be set back to the original value during each policy refresh.

Configuring the Desktop Wallpaper Storage Location

Now that you know the many options for configuring the Desktop Wallpaper via Group Policy the next thing you should consider is where is the wallpaper being stored. As you can seen in the screen shots of the administrative template Desktop Wallpaper that they use the example of a UNC path. But…

TIP #5: DONT EVER USE A UNC PATH FOR A DESKTOP WALLPAPER… EVER!!

Simple put using a UNC path puts a lot of stress on network as it has to download file every time the wallpaper is loaded. It also means that if the network path cannot be contacted when the user logs on all they will get is a black background wallpaper. This is particularly obvious when someone logs on with a laptop not connected LAN.

So the obviously question is how do you make sure that file that the desktop wallpaper uses is always available and easily accessible? Use a script and copy the file to the local hard drive. Sure… but http://ihatelogonscripts.com and the issue with using a script is that it will only run when the computer starts up or when the user logs on. Generally this would not be a problem and if you are smart enough to use a copy program like robocopy or other such program it wont stress your LAN as it will only copy the file once. But on the day that you change the desktop wallpaper ever computer and/or user will try to download the new wallpaper all at once.

The Answer? Use Group Policy Preferences File Extension and copy the file down to the local computer.

Using the Group Policy Preferences File Extension

Using the File Extension to copy the file to the local hard drive means the file will be copied to the local hard drive making obviously available at all times. However the File Extensions options also has the advantage of being able to updated the file during each group policy refresh. This way the computer gets the updated wallpaper without having to logoff or reboot the computer and you avoid slamming the network in the morning when all the computers turn on.

TIP #6: Setup the file copy as a computer setting so that it will update the files even when there is no user logged on.

TIP #7: If you follow Tip #6 then you need to make sure that the desktop wallpaper file has got “Domain Computers” Read permissions so the local system account has access to copy the file from the network.

So by now, hopefully you know how to set the desktop wallpaper and so you can ensure that the images you use for the wallpaper are always available that way you  can ensure that your users are always subjected to your corporate desktop wallpaper.

This week setting of the week allows you to prefer a custom logon background image in Windows 7. This setting is called “Always use custom logon background” and can be found under Computer Configuration > Policies > Administrative Templates > System > Logon.

Microsoft brought back the option to easily customise the logon background in Windows 7 as this was previously possible in Windows XP but it was removed with Windows Vista which left people with some pretty messy workarounds.

Once you have enabled this option all you have to do to create the “%windir%\system32\oobe\info\backgrounds” folder and populate it with a backgroundDefault.jpg image and your computer will then use that as the background image when logging on and off.

Note: Some sites will direct you to configured the OEMBackground or UseOEMBackground in the HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background however this setting will negate the need to set this key.

For more info on how to configure a custom background check out Windows 7 to officially support logon UI background customization

Another one…? yes… Another roaming profiles group policy for this weeks setting of the week. But this is a really super cool policy I found while reading the “What’s New in Folder Redirection and User Profiles” (via @stealthpuppy ) document that Microsoft recently published. This document mainly goes through the new features with folder redirections in Windows 7 however it also mentions the new group policy/feature called “Background upload of a roaming users profile’s registry file while user is logged on”.

This setting can be found under Computer Configuration > Administrative Templates > System > User Profiles and is specific to Windows 7 or Windows Server 2008 R2.

This policy setting would be very useful as a way to ensure that at least part of a users profile is save to the network if they are they type that never like to log off their computer at night.

There are a few points about this policy which I have summarised below:

• Only synchronises the users registry profile (ntuser.dat) so things like desktop icons and favourites wont sync. (This is what folder redirection is for any way).
• There are two modes of scheduling the update
  • Run at set interval – Between 1 hour and 720 hours (30 days).
  • Run at specified time of day – useful if you only want to run this at 3am so that it only applies to users who stay logged on over night.
• The schedule will run randomly any time up to an hour after it is supposed to run so to not load the file server with a large number of concurrent requests.
• If you choose one method of scheduling then it will ignore the set value of the other schedule.

I also have a very strong suspicion that this setting is only compatible if you have Windows 2008 (or later) as the file server so that it can handle the copying of the locked file (ntuser.dat). Please ping me if you can confirm this.

This weeks setting of the week is a double header but they are really simple but so commonly used that they really have to be mentioned.

The first setting is found under User Configuration > Policies > Administrative Templates > Control Panel > Personalization > Prevent changing desktop background. As the name suggest this setting prevents users from changing the background image via the Display Setting control panel applications however it does not prevent users from right clicking on an image and setting it as a background image.

Recommendation: Enabled

If you really want to stop users from changing the background image then you also need to configure the “Desktop Wallpaper” setting to specify a background image which can be found under User Configuration > Policies > Administrative Templates > Desktop > Desktop (yes Desktop is there twice).

Recommendation:  Enabled (specify path to background image)

These setting should be configured for anyone want to implement a standard background desktop image of their SOE computers. However be warned if you are going to implement this setting then expect to cop a lot of flack from your users complaining they cant set their background image to their favourite family photo or even worse their cat.