This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(230.39999999999998, 15%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EO%3C/text%3E%3C/svg%3E)
Hi
I'm moving all our group policies over to Intune Configurations and have noticed an issue with the lock screen background policy we use.
I've created a new configuration and have selected some entries from Administrative Templates > Control Panel > Personalization: - Force a specific default lock screen and logon image - TRUE
The configuration gets applied correctly. I can see a preview of the selected image from the UNC path in the Windows settings > Lock screen settings in Windows so it is pulling from the UNC path.
PROBLEM - If I lock the screen, I just get a blue screen as the backdrop (the selected Windows colour) instead of the image selected. Press CTRL-ALT-DEL to get to the sign in screen and the background is still blue.
If I manually download the same image file to the local drive and select it and lock the screen, the image displays correctly.
If I go back and reselect the UNC image, lock the screen I just get a blue screen again.
However, an oddity I noticed is that if I then turn off the "Show lock screen background picture on the sign-in screen" in the Windows settings > Lock screen settings panel and lock the screen, the image then displays correctly but doesn't show on the sign-in screen (as expected).
We are running Windows 10 Enterprise so this setting should work (it doesn't work for Pro).
I don't know if I'm doing something wrong, if it's a Windows 10 bug or an Intune bug.
Anyone have any ideas?
Many thanks,
Olly
Partital solution - I didn't manage to find the underlying cause of the strange issues (I suspect a bug in Windows), I did discover that if I changes the security of the image I needed for the lock screen, and added "Everyone" as read-only, then it displays correctly. Previously the file was only set for Domain Users (read-only).
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 30%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
@ollyRCPCH, Thanks for sharing the solution. For the UNC permission, could you confirm if we add Domain Users permission at the same location as everyone? Did it have both share permission and NTFS permission (Under folder, security)?
So the folder on the server where the images are stored is nested in a folder which is shared with a hidden share. That hidden share only has Domain Users (Read) listed and still does. The only change was adding Everyone (Read) NTFS permissions to the actual image file itself. With only Domain Users (Read) in the NTFS permissions you get blue screen.
@ollyRCPCH, Thanks for the reply. If so, it looks like other account is used to access the share when reading the lock screen background image. To know this in more details, it is better to open case with windows support to look into it.
@ollyRCPCH, Thanks for posting in Q&A. For the Lock screen image, from the CSP description, it shows the image can store on http or https URL or on local. For UNC it is not supported. Therefore, when you store it locally, it works. But when you choose UNC path it *is failed. this is by design.
You can consider storing the image on https or http url. Here is a link list steps to store the image on Azure storage container and configure lock screen image for your reference.
https://cloudinfra.net/how-to-set-desktop-and-lock-screen-wallpaper-using-intune/
Note: non-Microsoft link, just for the reference.
Hope the above information can help.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
I'm not sure that's quite right. If you hover over the tool tip for the config item in Intune it states that UNC path is allowed (screenshot). The link to the "Learn More" at the bottom takes you to this page which also states that UNC paths are allowed:
It even shows the image in the preview in the Windows control panel for Lock screen, so it looks to be pulling it correctly into Windows.
@ollyRCPCH, Thanks for the reply. In the above policy, it shows can be configured for UNC path. It mainly for Microsoft Entra Hybrid Joined device which we can grant current login user with permission to access the UNC path. If our device is Microsoft Entra joined device, based as I know, we can't grant the Microsoft Entra user with read permission on the UNC path which will block it.
Thnaks for the reply. The device is hybrid joined, and it does pull it through as it shows in the preview.
It weirdly also shows if I disable the "Show lock screen background picture on the sign-in screen" option on the Lock screen CP. However, I need to also enable "Prevent changing lock screen and logon image" setting which removes this option if set.
@ollyRCPCH, Thanks for the reply. After we disable the "Show lock screen background picture on the sign-in screen" via policy, please check if the following registry key has been changed.
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System]"DisableLogonBackgroundImage"=dword:00000001
Also, please restart the device after the policy is applied to see if it works without configuring "Prevent changing lock screen and logon image" setting.
Strange, I don't have the registry setting at that location or anywhere in my registry with that option enabled or disabled.
I can some registry setting that look to be holding the UNC path to the image:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\4D2E51D4-20D9-4775-9D50-32DE50C71E15\default\Device\ADMX_ControlPanelDisplay]"CPL_Personalization_ForceDefaultLockScreen"
and
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization]"LockScreenImage"
Device has been restarted a few times with no change.
@ollyRCPCH Thanks for the reply. From your description, I know the registry key under the following location have been changed.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\4D2E51D4-20D9-4775-9D50-32DE50C71E15\default\Device\ADMX_ControlPanelDisplay]"CPL_Personalization_ForceDefaultLockScreen"
and
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization]"LockScreenImage"
But it is still not working after restarting. For the affected device, could you confirm if it is with the required KB installed?
The devices are Windows 10 Enterprise 22H2 19045.5011 with the latest CU installed (KB5044273).
The devices are Windows 10 Enterprise 22H2 19045.5011 with the latest CU update installed (KB5044273).
@ollyRCPCH Thanks for the reply. I notice your version is Windows 10 22H2 with KB5044273 installed. Then I go to test in my lab. After testing, I find the registry key under the following location have been changed and the device background lock screen image is also changed when I lock the device. My device is also windows 10 22H2.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\4D2E51D4-20D9-4775-9D50-32DE50C71E15\default\Device\ADMX_ControlPanelDisplay]"CPL_Personalization_ForceDefaultLockScreen"
and
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization]"LockScreenImage"
And at this time, "Show lock screen background picture on the sign-in screen" on the computer is unable to change because of greyed out. And the status is on. Different result with yours. I guess if the issue is with the UNC path. If we create a UNC path on the affected user device and use this one. Will the affected device get the image when lock?
The "Show lock screen background picture on the sign-in screen" Windows option only shows if you disable the "Prevent changing lock screen and logon image" in the Intune configuration:
If I then disable this option in Intune I then get the ability to adjust the "Show lock screen background picture on the sign-in screen" in Windows.
I also tried a local UNC path which works! Very strange.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(300.8, 5%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EH%3C/text%3E%3C/svg%3E)
I am running into a similar issue with the lock screen. We are using windows 10 pro currently and getting the same thing, lock screen not applying or getting a blue screen. Can someone point me in the direction for if this works or any fixes for 10 pro? I've already tried everything detailed here and in other threads.
According to the documentation for this setting, it only works for Enterprise, Education and Server editions of Windows.
I can't find it now but I'm sure I came across an article describing an alternative option for Pro where via a script the image is copied to the local drive and selected from there. This was going to be my next attempted fix until I resolved with adjusting the permissions of the file.