-1

This isn't a typical question and I thought of posting this to Programmers Stack Exchange, but I believe here is more fitting.

What I want to do is monitor the Windows background or Login screen from being changed. I'm not entirely sure what the best way to go about this is, but any hints would be great.

Chris
  • 195
  • 3
  • 8

2 Answers2

1

There is a group policy that specifies walpaper (or background) and another one denying user from changing it

Check user configuration - admin templates - desktop

strange walker
  • 582
  • 3
  • 10
  • In this case the setting is going to be in the registry. The domain the computers are a part of do not have any restrictions or specify the wallpapers. – Chris Aug 19 '13 at 21:22
  • does policy name "Prevent changing wallpaper" tells something to you? btw, in windows _all_ configuration is stored in registry, and if your users have unrestricted access to it, wallpapers is the least of your problems – strange walker Aug 19 '13 at 21:28
  • No, wallpapers are NOT the least of our problems. We are an IT shop. We ALL have access to the domain settings. That being said, you never listened to my original question. I never said that I want to prevent users from changing anything. I know full well the settings in GP that can set/prevent wallpapers from being changed. What I want to know is what would be the best to MONITOR if a wallpaper has been changed, so that WHEN it is changed I can trigger an event! – Chris Aug 20 '13 at 13:25
  • Ok, my apologies. Misunderstanding came from insufficient background I think. As I already said, configuration stored in registry, wallpaper in particular. You can find the exact branch where it is stored and monitor it with WMI or SysInternals utilites. – strange walker Aug 20 '13 at 13:47
0

OK, I figured it out myself. Here is what I did. The file that is actively used for the logon screen is located here:

C:\Windows\System32\oobe\info\backgrounds\BackgroundDefault.jpg

There actually is no need to change anything in the registry from what I understand, but the image itself just has too meet certain requirements in terms of size and colour depth. That file is what is displayed as the Windows logon screen. Simply replace the file with an image of your choice and you're good to go.

edit: it seems you need to have this flag in the registry set in order for non-Windows logon screen to work. Just set the value to 1. If your computer has an OEM logon screen then it should already be set:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background

So here is a script I wrote to monitor the folder for changes. Now to give a bit of background, the whole point of this was to stop someone from remotely changing my background. A certain person kept playing a prank on me and kept changing my logon screen to Justin Beiber or something whenever I stepped away from my desk. But he accomplished this by renaming my current "BackgroundDefault.jpg" to .old or something and then copied in his image.

So my script monitors the folder for number of files. If it detects more than one file, then it empties that folder and restores a copy of my background image from an alternate location. Then in a retaliation move, it automatically copies an image of the Backstreet Boys to his computer making it the logon image for his computer. Sounds childish, but it got him to stop.

@echo off
cd C:\Windows\System32\oobe\info\backgrounds
for /f %%A in ('dir ^| find "File(s)"') do set cnt=%%A

if %cnt% GEQ 2 GOTO :revenge
if %cnt% EQU 1 GOTO :exit

:revenge

del * /F /Q
copy C:\temp\temp2\mycomp\BackgroundDefault.jpg C:\Windows\System32\oobe\info\backgrounds
rename \\otherguy-pc\c$\Windows\System32\oobe\info\backgrounds\BackgroundDefault.jpg BackgroundDefaultOLD3318.jpg
copy C:\temp\temp2\otherguy\BackgroundDefault.jpg \\otherguy-pc\c$\Windows\System32\oobe\info\backgrounds\

:exit

Since I was running this script simply as a scheduled task, I actually ran the script through this .vbs script:

Set noShell = CreateObject("WScript.Shell")
noShell.Run chr(34) & "C:\Users\cblasko\Documents\revenge.bat" & Chr(34), 0
Set noShell = Nothing

The reason for the vbs script is so that when the script runs every 5 minutes I don't have a command prompt window flash every 5 minutes. The script suppresses the window and instead runs it in the background.

Anyways, mission accomplished. No more annoying pictures when waking up my computer.

Chris
  • 195
  • 3
  • 8