Easily configure desktop and lock screen image via Windows 10 MDM

This blog post uses the Personalization configuration service provider (CSP) to manage the desktop and lock screen image on Windows 10 devices. This CSP was added in Windows 10, version 1703, which is currently available as Insider Preview build.

This blog post is about the ability to easily configure separate images for the desktop and the lock screen on Windows 10 devices. Before Windows 10, version 1703, this was possible by using an MSI or by using the EnforceLockScreenAndLogonImage setting. However, the latter setting was only able to configure the lock screen image and not the desktop image. Windows 10, version 1703, introduces the Personalization CSP, which enables the administrator to manage the desktop and lock screen image. In this post I’ll briefly go through the available settings in the Personalization CSP and I’ll show how to configure the desktop and lock screen image via Microsoft Intune hybrid and Microsoft Intune standalone. I’ll end this post by showing the end-user experience.

Configuration

Now let’s start with the configuration. Like last week I’ll split the configuration in two sections. The first section is about the available settings in the Personalization CSP and the second section is about the configuration of the desktop and lock screen image.

Available settings

As the Personalization CSP is new in Windows 10, version 1703, I thought it would be good to briefly go through the available settings. The root node for the Personalization CSP is ./Vendor/MSFT/Personalization and it contains the following settings.

Setting Description
DesktopImageUrl This setting allows the administrator to specify an image to be used as desktop image.
DesktopImageStatus This setting allows the administrator to query the status of the desktop image.
LockScreenImageUrl This setting allows the administrator to specify an image to be used as lock screen image. 
LockScreenImageStatus This setting allows the administrator to query the status of the lock screen image.

Configure settings

After going through the available settings in the Personalization CSP, it’s good to know that only the DesktopImageUrl and the LockScreenImageUrl are configurable settings. The other two settings can only be used to query the status. To configure the desktop and lock screen image, the following OMA-URI configurations can be used (in both cases the data type and value are the same):

  • OMA-URI – Desktop image: ./Vendor/MSFT/Personalization/DesktopImageUrl
  • OMA-URI – Lock screen image: ./Vendor/MSFT/Personalization/LockScreenImageUrl
  • Data type: String
  • Value: [<PATH>\<FILE>]
    • In this value <PATH> can be a http(s) url, or a file url;
    • In this value <FILE> can be a jpg, jpeg or png image.

This configuration information can be used in Microsoft Intune hybrid and Microsoft Intune standalone, by using the configuration guidelines shown below.

Environment Configuration guidelines
Microsoft Intune hybrid

Personalization_IntuneHybridThe configuration in Microsoft Intune hybrid can be performed by starting the Create Configuration Item Wizard in the Configuration Manager administration console. Make sure to select Windows 8.1 and Windows 10 (below Settings for devices managed without the Configuration Manager client) on the General page and to select Windows 10 on the Supported Platforms page. Now select Configure additional settings that are not in the default setting groups on the Device Settings page and the configuration can begin by using the earlier mentioned OMA-URI settings.

Once the configurations are finished, the created configuration items can be added to a configuration baseline and can be deployed to Windows 10 devices.

Microsoft Intune standalone (Azure portal)

Personalization_IntuneStandaloneThe configuration in Microsoft Intune standalone, in the Azure portal, can be performed by creating a Device configuration. Create a new profile, or add a row to an existing custom profile. With a new profile, make sure to select Windows 10 and later as Platform and Custom as Profile type. In the Custom OMA-URI Settings blade, add the custom settings by using the earlier mentioned OMA-URI settings.

Once the configurations are finished, the profile can be saved and can be deployed to Windows 10 devices.

End-user experience

As usual, let’s end this post with the end-user experience. Before really going to the end-user experience, it’s good to show an easy method to verify the configuration. The configuration can be verified In the registry, at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP. At this location it shows the url and the status of the desktop and lock screen image. Even better, it also show the local path of both images. In other words, whether the image is local, or remote, it will always be cached and used from a local location, as shown below.

Registry_Personalization

The real end-user experience is, of course, not in the registry. The real en-user experience can be easily found when logging on to the configured Windows 10 device. The desktop image will be configured, as shown below on the right, and the lock screen image will be configured, as shown below on the left.

LogonScreen_Example Desktop_Example

More information

For more information about the Personalization CSP, please refer to this article about the Personalization CSP.

63 thoughts on “Easily configure desktop and lock screen image via Windows 10 MDM”

  1. FYI: The Personalization CSP is only available on Windows 10 Enterprise and Education SKU, see More information section in this article.

    Reply
  2. One thing I found was that if the Personalisation button under settings was turned off the policy would not apply on a Windows 10 device.

    Hope this helps people

    Reply
  3. Hi Peter,
    Can you confirm if the url can be within a sharepoint environment? It doesn’t seem to work for me but Ive successfully rolled out an image published on the internet.

    If not, how can I deploy an image to all user devices to then link to.

    Thanks,

    Kevin

    Reply
    • Hi Kevin,
      I haven’t specifically tested with a SharePoint environment, so I can’t confirm the behavior. Theoretically speaking, it should be an URL to which the user has access, which doesn’t directly exclude SharePoint.
      Regards, Peter

      Reply
  4. This is perfect, thanks so much!

    Any idea if/how often it polls for a new image? I couldn’t get it to update without renaming the image and changing the configuration policy.

    Reply
  5. Hi Peter,

    Nice article, but you might want to consider placing the “only available on Windows 10 Enterprise” FYI somewhere on top in the article. I am new to Intune and just spent a couple of hours trying to change the desktop of my Windows 10 Pro clients with this method….. 🙂
    Or are there other clues that should have rang any bells?

    Regards,

    Reply
    • Hi Glenn,
      Yeah, I know. However, I didn’t do that due to the note on top of the page of the Personalization CSP: “Personalization CSP is supported in Windows 10 Enterprise and Education SKUs. It works in Windows 10 Pro and Windows 10 Pro in S mode if SetEduPolicies in SharedPC CSP is set.” So, basically there is a method to make it work in Windows 10 Pro.
      Regards, Peter

      Reply
  6. Has anyone found a way to disable Windows Spotlight via CSP also ?
    The feature that that gives tips and facts on the lockscreen.

    Reply
  7. hi there
    i used a script to download an image I created.
    “$url = “https://XXX.com/XXXYYY”
    $output = “c:\background.jpg”
    Start-BitsTransfer -Source $url -Destination $output”

    So my image is downloaded in c:\background.jpg.

    But then, i used these CSP…and….not working !
    In the registry, DesktopImageStatus and LockScreenImageStatus are at “2”
    2 mean “download or copy in progress” (https://docs.microsoft.com/en-us/windows/client-management/mdm/personalization-csp)
    But my image is downloaded….!

    I don’t understand….

    Reply
    • Hi Dan,
      You can simply specify the web location and it will download it locally itself. Also, nowadays you can also use a configuration policy to configure this setting via the UI.
      Regards, Peter

      Reply
  8. where is this config policy ? it only works with “enterprise sku” right ?
    that’s why i’m using this csp…:-)

    the problem is : i created a personal image. So i need to upload this image somewhere. It doesn’t seem to work with sharepoint. and i don’t want to upload this image on some website….

    Reply
  9. I tested on, 1809 machine. The image URL is dilivered to the registry location but is not taking effect on the device, both Lockscreen and desktop wallpaper

    Reply
  10. Hi Peter,

    Is it ok to use edu policies in w10 pro in regards to licens? Dont you need to be eligible for Education or enterprise licenses?

    Reply
  11. Thank you!
    I have a w10 pro controlled by intune and wanted lockscreen enabled, which seemed to work when I enabled setEduPolicies but Im uncertain about being compliant with ms licensing since I dont have enterprize or edu sku?

    Reply
    • Hi Johan,
      I’m not a licensing expert, but to my knowledge you are allowed to configure whatever you can configure. Sometimes that just means that the easy road is not possible.
      Regards, Peter

      Reply
  12. So my device is Wind 10 1809 Pro, I used the Set EDU policy
    then deployed desktop background and Lockscreen.
    In the registory, I see that the Dword value 6, istead of 1 and no Desktop image Path / lock screen path

    Reply
  13. Peter – many thanks for this, the Experience CSP thing is where I’m stopped now. I can use the PersonalizationCSP things to create reg keys from GPO that let me specify lock screen image, but still getting Windows Spotlight info overlays. I see there’s an Experience CSP that can turn that off but I’m a little lost getting from that info to a reg key for non-intune devices.

    Reply
      • Hi Peter – yes, that’s true – I mistyped – You can turn off the Spotlight stuff under the Policy CSP in an Experience section, but just as the Personalization CSP maps to reg keys and can be set with GPOs, I figure that the PolicyCSP can be as well. But I’m not skilled enough to figure out the reg key to deal with the Spotlight issues. I can set the regkeys you identify in the above image with a GPO, and I got the picure I set as the lockscreen background, but Spotlight was locked in settings as the default lockscreen, and the spotlight “Like what you see?” overlays kept appearing over the picture I set. I think there’s a clue in the Policy CSP Experience ConfigWindowsSpotlightOnLockscreen setting, but I don’t know how to figure out what the reg key to set with GPO is from the CSP info. You’ve halfway let the cat out of the bag here, maybe let’s let him all the way out?

        Reply
  14. Does the user on the device have to be a local admin?
    The setup only works for 1 device (which is global admin in azure) all other devices gives this error: Syncml(406): The requested command failed because an optional feature in the request was not supported.

    Any ideas what that could be about?

    Reply
  15. Hi Peter, thank you for quick reply. I use Windows 10 Pro version 1909. I have Enabled SharedPC Mode on the devices. Just strange that it works for the global admin but not for anyone else.

    Reply
  16. Hi Peter, Thank you for this wonderful article, I am looking for enterprisedesktopappmanagement-csp, can you help me with it, from Microsoft doc it’s not very clear about what values has to be passed for every OMA-URI configurations. one example would help me .

    Reply
  17. Great article Peter and thanks for sharing but like others i’ve hit issues with the joy of working with Windows 10 Professional rather than Windows 10 Enterprise. I repeatedly find issues around these custom controls not working on professional edition. Really important imho that you flag this at the start of your articles.

    I don’t want to be enabling education mode on my build as it would be potentially too restrictive.

    Reply
  18. Hi Peter, thanks for this! Although doesn’t seem to work for me I think I must be doing something wrong but cant figure out what! The only difference I can see is that where your Desktopimagestatus and Lockscreenimagestatus is set to 1 mine is set to 3? What does this mean and how do I rectify this? Please help!

    Reply
  19. Hello Peter,

    I have set the wallpaper for the user machine but at the same time, I want to allow users to change the wallpaper as per their preference. Any suggestions

    Testing this scenario but so far no success.

    Reply
  20. Is there an update for this?
    The option is still there in device configuration, but ATM I can not use it (we are 100% cloud based with no storage)
    it does not appear to accept a SharePoint url – no surprise.

    also.
    the reg entry listed above no longer seems to be used – I cant find it even when searching for PersonalizationCSP

    Reply
  21. Hi,

    I am using windows 10 business and I am unable to find personalization CSP on that after making all the changes. Is there any other way to implement this.

    Reply

Leave a Reply to Edouard Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.