Group Policy is of course one of the best ways you can lockdown and configure your windows systems in your environment and one of the most commonly configured setting in Group Policy is the ability to configured the Desktop Wallpaper (a.k.a. Background) image. Now most of you might just say is all you need to do is set the group policy setting however there are some common traps that you might fall into if you don’t use this setting correctly.
Method #1: Administrative Template “Desktop Wallpaper” Setting
The “Desktop Wallpaper” method is of course the most commonly used way for configuring the Wallpaper on a computer however as it seems with all things Group Policy using this setting comes with its own pro’s and con’s.
Pro’s
- Change is Restricted for the users
- Works on all versions of Windows
Con’s
- Limited targeting only based on standard Group Policy Object’s (OU,Security Filter,Site,WMI & Domain)
This setting can be found under User Configuration > Administrative Templates > Desktop > Desktop and is straight forward to configure as all you have to do is specify the explicit local path or a UNC to the image you want displayed as the desktop wallpaper (see below).
Behind the scenes all this setting is doing is configuring the REG_SZ “Wallpaper” and the REG_SZ “WallpaperStyle” registry keys under the HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System path.
TIP #1: If you are running Windows 7/Server 2008 R2 pre-Service Pack 1 you will need to install hotfixhttp://support.microsoft.com/kb/977944 for this setting to work.
TIP #2: If you are configuring this setting I recommend that you use the “Fill” Wallpaper Style as this will work best with most screen resolutions (especially on Windows 7).
TIP #3: If you configure this setting you will need to wait for the user to logoff the computer before the background is updated.
Method #2: Group Policy Preferences Registry Key Wallpaper Configuration
As I mention in Method #1 all the Administrative Template “Desktop Wallpaper” does is configure the HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System REG_SZ “Wallpaper” key. Therefore you can also use the Group Policy Preference Registry Extension option to also set the same key to give you some added benefits.
Pro’s
- Support advanced targeting option due to Group Policy Preferences Item-Level Targeting
- Change is Restricted or Unrestricted for the user
Con’s
- Must run Windows XP (or greater)
- Must have the Group Policy Client Side Extensions installed.
To configured the Desktop Wallpaper the same as the “Desktop Wallpaper” administrative template simply create two registry keys User Configuration > Preferences > Windows Settings > Registry (see below). Now depending on the registry key that you configure for this setting you can either have this as a restricted (a.k.a. locked) setting or an unrestricted setting that allows the users to make their own changes.
Restricted: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper
Unrestricted: HKCU\Control Panel\Desktop\Wallpaper
Restricted: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\WallpaperStyle
Unrestricted: HKCU\Control Panel\Desktop\WallpaperStyle
Tip #4: If you don’t configured the “WallpaperStyle” registry key then users will still be able to choose their own Wallpaper Style.
If you chose the restricted registry keys to configured the wallpaper then ensure you also select the “Replace” action and “Remove this item when it is no longer applied” common option is selected (see below). If you don’t do this you will find that your users will not be able to change their wallpaper even after the policy is removed as the policy registry key will not be removed.
If you chose to use the unrestricted registry key values then also make sure you chose the “Apply once and do not reapply” option. If you don’t do this the users wallpaper will be reset ever time they log off their computer as the key will be set back to the original value during each policy refresh.
Configuring the Desktop Wallpaper Storage Location
Now that you know the many options for configuring the Desktop Wallpaper via Group Policy the next thing you should consider is where is the wallpaper being stored. As you can seen in the screen shots of the administrative template Desktop Wallpaper that they use the example of a UNC path. But…
TIP #5: DONT EVER USE A UNC PATH FOR A DESKTOP WALLPAPER… EVER!!
Simple put using a UNC path puts a lot of stress on network as it has to download file every time the wallpaper is loaded. It also means that if the network path cannot be contacted when the user logs on all they will get is a black background wallpaper. This is particularly obvious when someone logs on with a laptop not connected LAN.
So the obviously question is how do you make sure that file that the desktop wallpaper uses is always available and easily accessible? Use a script and copy the file to the local hard drive. Sure… buthttp://ihatelogonscripts.com and the issue with using a script is that it will only run when the computer starts up or when the user logs on. Generally this would not be a problem and if you are smart enough to use a copy program like robocopy or other such program it wont stress your LAN as it will only copy the file once. But on the day that you change the desktop wallpaper ever computer and/or user will try to download the new wallpaper all at once.
The Answer? Use Group Policy Preferences File Extension and copy the file down to the local computer.
Using the Group Policy Preferences File Extension
Using the File Extension to copy the file to the local hard drive means the file will be copied to the local hard drive making obviously available at all times. However the File Extensions options also has the advantage of being able to updated the file during each group policy refresh. This way the computer gets the updated wallpaper without having to logoff or reboot the computer and you avoid slamming the network in the morning when all the computers turn on.
TIP #6: Setup the file copy as a computer setting so that it will update the files even when there is no user logged on.
TIP #7: If you follow Tip #6 then you need to make sure that the desktop wallpaper file has got “Domain Computers” Read permissions so the local system account has access to copy the file from the network.
So by now, hopefully you know how to set the desktop wallpaper and so you can ensure that the images you use for the wallpaper are always available that way you can ensure that your users are always subjected to your corporate desktop wallpaper.
No comments:
Post a Comment