Known Lock Screen issues with Creator’s Update (1703)


Updated 11/27/2017

There are a few open issues with Lock screen setting on Windows 10 Enterprise build 1703 (Creator's Update)

 

Resolved: The first is with the Group Policy setting "Force a specific default lock screen image" under

Computer Configuration\Administrative Templates\Control Panel\Personalization

In many cases trying to enabled, change or update this doesn’t appear to work for new or existing users in the environment.

This will happen if "Prevent changing lock screen and logon image" policy is also enabled.

One of the key indicators of this is when you see the desired lock screen image in Settings under Lock screen as the preview but the controls to change are greyed out.

2017-05-05_11-30-18

Many people have sent me that screen shot and said - "See, that's the image I want to appear!" not noting that since its greyed out it also means the "Prevent" lock screen is in play.  When Prevent is disabled it should look like this:

2017-05-05_11-27-52

 

This issue is fixed in beta builds and an update released last week in May KB4020102

The workaround is to set "Prevent" to Disabled or Not Configured, apply that change and then make the desired updates to "Force".  If there are still issues with Force at this point, test applying it in an OU that blocks inheritance for all other polices to confirm there isn't something else in play.

The "Force" policy does work by default, with no other policies enabled.

 

The second issue is when Animate settings are changed on the system, the Lock Screen will be black. The time and other text will appear normally, the lock screen with work normally, users will just see black instead of the desired picture.

The setting specifically, under Advance System Settings, Settings under Performance - Animate window minimizing and maximizing is unchecked.

2017-05-05_10-12-08

Or when the policy "Do not allow Windows animations" is enabled under

Computer Configuration\Windows Components\Desktop Windows Manager

2017-05-05_10-29-30

The workaround for this one is to not enable the policy or uncheck the setting.

This issue was present in 1607 and fixed with the last February Cumulative update but the issue seems to have returned in 1703 and we're currently investigating it.

 

Additional issues 7/7/2017:

The fix for the first issue implemented new image cache and algorithm.  Initially, when "Prevent..." was applied it would block any changes made to "Force..." policy.  After the May update this has changed and may have some side effects. Some reports I'm seeing are:

  • This is not reproducible 100% of the time.
  • Some machines will work and some will not with the same settings.
  • Resetting the policies to Not Configured and reenabling does not resolve the behavior
  • Some users report this issue without any Group Policies, users not able to change it via Settings
  • Changing the location of the lock screen image on the system may work
  • Lock screen reverts/changes to Cave after resolution change
  • Lock screen behavior is inconsistent when Docked vs Undocked

These symptoms are not all a result of the May update and are not necessarily all the same issue but one issue that we are working on is with the new image cache implementation.  The workaround for this issue is:

  • Copy the image you want to a second path and update the policy with the new path.
  • Update the Last Modify Timestamp of the image referenced in the policy.
  • Backup and delete the folder C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18\ReadOnly\LockScreen_P

9/19/2017

Just got word this secondary issue to the custom image is in RS3 builds now which means it should be in the Fall release (barring any last minute issues)

 

11/27/2017

We've been looking into an additional issue where lock screen does not work when the above polices are in play AND users are implementing this reg entry reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System /v DisableLogonBackgroundImage /t REG_DWORD /d 1

This comes into play if you view the lock screen and the logon screen as two separate entities.  In Windows 10 these two screens are closely linked and can be thought of as one presentation.  But in previous versions of Windows they were two elements.  The DisableLogonBackgroundImage is for the screen with logon box only.  Enabling this will present a solid color background.  In current Windows 10 builds this key in combination with "Force..." may not work as expected.

This issue has been fixed and will soon hit flighted builds for Insiders.

Hope that helps!

Comments (60)

  1. HelgeKlein says:

    One incarnation of the black lock screen is well documented on my blog: https://helgeklein.com/blog/2017/02/windows-10-black-lock-screen-citrix-receiver/

    The root cause is Citrix Receiver calling SystemParametersInfo with SPI_SETANIMATION.

  2. HPO says:

    Hi Kimberj,

    The lock screen doesn’t apply even with the changes you mentioned above.

    1. Is this Enterprise or Pro and do you see the preview correctly in the Settings app or no change in Settings?

      1. Jeremy D says:

        I’m seeing this on the Education version of 1703. I’ve reverted the policies you mentioned and the lock screen still doesn’t force to the image I specified.

  3. Drew A says:

    All of our 1703 computers are having “Issue 1” I cant get it to work on any of them, using an Enterprise sku and attempted the workaround.

    1. If you put a system in an OU that blocks all policies, and test just setting the “Force” group policy, does that work? I’m hearing reports of additional issue(s) but have not gotten clear repro steps. Blocking all and setting it on the machine locally will clear out any other possible GP issues. If it works locally but fails again when back in a normal OU there’s likely another GP in play. I’d love to hear if that helps narrow down the issue.

      1. Drew A says:

        Kimberj,

        We have some enforced policies that I cant disable (and those have nothing to do with personalization), but I placed the user and computer in an ou with block inheritance enabled. I did a gpupdate /force on an existing user, no change. I logged off of that user, logged on as a new user (new to the computer) that user received the proper lock screen. Please note I did not test this with the same user prior to making the new OU and test GPO. Thing is this working for new profiles is great, but I’m looking to push the 1703 update to my general population very soon, and since we are in advertising this is probably going to delay the deployment since we are very brand oriented. Thanks for your help.

  4. Matt Gailer says:

    I only have the “Force a specific default lock screen and logon image” enabled (using an image that is local, not a UNC path) and I have the issue. This worked fine on build 1607, and worked fine on machines that were in-place upgraded from 1607 to 1703. It’s only fresh builds that are doing this. Oddly enough, on occasions it works as expected. But mostly it is failing.

    1. For the issues that occur without having “Prevent” enabled – is there any change in behavior between an existing user and a brand new local user account on the machine?

      1. Andreas Björklund says:

        I’m in the same situation for Windows 10 Enterprise. Upgraded to .332 just now, and it doesn’t seem to be solved yet. Only have “Force a specific default lock screen and logon image” enabled and it doesn’t matter if there is a new or old user logging in for me.

        1. Robert Silva says:

          Windows 10 EDU. Broke on creators update install (through Windows update) and most recent CU doesn’t resolve issue in our environment with existing images upgraded to Creators through Windows Update.

        2. Alex Pooley says:

          Issue still exists with build KB4020102 (OS Build 15063.332).

          We are using “Force a specific default lock screen and logon image” to a UNC path.
          Prevent changing lock screen and logon image = Enabled
          Prevent enabling lock screen slide show = Enabled

          No enforced or blocked inheritance within the GPOs

      2. No change between existing user or brand new user. What I have seen is that the custom image will show for 2-3 seconds, and then you see it fade out and it stays on the default logon image. I’ve just done a 2nd site with a fresh 1703 build, and it’s the same result. What’s the fix that is mentioned for release on 24th May?

        1. The fix in May was for a specific issue where the Prevent GP was overriding Force GP. That issue has been fixed, but as you can see we’re still seeing side issues that appear related. The difficult part is that once the May fix is installed in my lab environment – I am not able to repro the additional side issues. This just means there is a variable(s) out there that needs to be identified… We’re investigating issues that persist after the May update.

  5. Jim Molnar says:

    When the Creator Update was applied to my companies Surface Hub, Remote Desktop App (From the Windows Store) stopped working on the Hub. Is this a known issue or repeatable?

    1. I’m checking on our hub – it should still work, afaik.

      1. Just got confirmation that there was an issue that was fixed with June patch released this week(6/27). If the devices are up to date they should be back up and running!

  6. DAllston says:

    My Enterprise 1703 clients, who are fully patched as of 6/15, are still having trouble with the lock screen not working as expected. Is there any updates other then the one posted on May 30th about progress on this? This is the only blocking issue we know of keeping us from rolling this build out company wide.

    1. There are several variations of issues with lock screen. Can you detail what not working as expected means?

      Note – Once a user changes lock screen on their own, Force will not work (Which is why we have the Prevent GP.) User preferences overrule the Force GP in this instance. So if users have changed off of the default lock screen (Cave picture in Windows 10) Force GP will not appear to take effect.

      1. Alan Dooley says:

        Based on that what is the approach to undo the users original setting? Surely it is just removing a reg key in their profile? We are seeing mixed results on machines which are all in the same OU with the same GPOs and I’m wondering if it is because some time ago, pre 1703 they had set their own image…

        1. Hi All – I’ve updated the article with some additional information. I’m specifically interested if changing the location of the lock screen image file or backing up/deleting the image cache helps mitigate the issue.
          Thanks for all the comments and information around Lock screen issues. I know it is frustrating for something that should be cut and dry to be so fussy (believe me) and we’re hammering on this until it works!

          1. Xeraxx says:

            Changing the location of the lock screen image seems to have finally fixed it for me. I also disabled the “Prevent changing lock screen” earlier on but that had no effect by itself. I didn’t have to delete that image cache.

          2. Adam Fowler says:

            Hi,
            Had this problem and was directed here. Getting inside that SystemData folder was tricky, so thought I’d just try to change the policy ‘Force a specific lock screen and path’ to a different location – from a location on C:\ to a DFS share.
            Doing that, running gpupdate and nothing else seems to have fixed it. Locked workstation, and there was our custom image. The modified date of the file wasn’t changed, and is still from 2013.
            Hope that helps 🙂

      2. Justin Warner says:

        I’m seeing the same issues here on Win 10 Edu;. I changed policy to remove the “Prevent” GP setting, and only apply the “Force” pointing to an image in the NETLOGON share. Any machine that has installed the 1703 update no longer displays the assigned image. Previous builds across 1507, 1511 and 1607 all seemed to work with both Prevent and Force enabled. Now I can’t get it to work at all. Which KBs are relevant to fixing this issue?

      3. Alan Dooley says:

        I currently use both settings – Prevent changing lock screen and logon image and Force a specific default lock screen and logon image. On the most part it does work in 1703 but I still have some clients which don’t apply correctly.

        I tried not configuring Prevent changing lock screen and logon image. This then allows the user to change the lock screen image. Interestingly if they change it to something other than ‘caves’ it changes to what they selected. If you then re-enable ‘Prevent changing lock screen and logon image’ it forces them back to ‘caves’ and not to the image you have set via ‘Force a specific default lock screen and logon image’

      4. Justin Warner says:

        Additionally, manually setting the desired lock screen has no effect. The “force” setting seems to be ignoring the image I’ve configured and is just forcing the default image instead. I’m currently running 2017-06 cumulative update on Win 10 Edu 1703.

  7. Fred Tsui says:

    Hi there –

    I’m still not getting the lockscreen to set for either an existing user or a new user.

    I’ve updated my EDU1703 with the 2017-06 Cumulative Update for 1703 (KB4022725). I’ve set the image as a local policy. My district AD does not set this. I made sure that users are not prevented from changing the Lockscreen. And nothing changes.

    1. Hrm – Local Policy with a local .jpg file? Are the users local users or domain users? and Force is the only Lock Screen policy set?

      1. Awis13 says:

        Same problem, updated to version 15063.413 and no changes, Lock Screen still wont show, if Show lock screen background picture on the sign in screen is turned on.

      2. Fred Tsui says:

        I’m using png files. The users are domain users and I only modified the setting to force a lockscreen image.

      3. Fred Tsui says:

        I’m using a png. I made sure that I’m only using the Set Lockscreen GPO only. The users are domain users.

      4. Fred Tsui says:

        Sorry if this is the 3rd reply. I don’t see my replies show up with a moderation warning so I don’t know if they are registering.

        I am using png files. I’m using domain users and Force is the only local policy set

  8. Alan Dooley says:

    Thanks for the workarounds. I edited the metadata on the image referenced in the policy in order to change the modified date. This has resolved it on my 1703 clients which were seeing the issue.

  9. Marcus Rath says:

    Great Kimberj! Thanks for sharing. For me changing the location of the logon image does the success. To be sure I changed both source and destination in the gpo and disabled the two prevent settings.

    best regards,
    Marcus

  10. Marcus Rath says:

    Additional after changing the path and disabling the prevent policies it works, I tried again with a new machine and 1703 version if it works on the new installed machine with the prevent policies and it doesn’t work and shows the default windows logon/lock screen. In this case disabling the prevent settings again wasn’t enough to get the image from the gpo and I had to change the path of the image on the local system again to work.

    So it seems every time a 1703 client applied the policy with the prevent settings the only way to get the customized gpo logon image after this is to change the destination path in the gpo.

    1. yes – That is a secondary issue with the new image cache handling. To (hopefully) clarify the issues here
      Builds 15063.0 until 15063.332 = Problems with Force+Prevent GPs, fixed in 15063.332
      Builds 15063.332+ = problems with image cache, still being addressed. Workaround is to move the image location.

      Just a quick question for those posting that moving the image works – Are the images stored locally on the client machine or on a network share?
      Thanks!

      1. Marcus Rath says:

        yes Kimberj, the gpo also had an entry to copy the image from a network share to the client computer locally to c:\Windows\Wallpaper and if the problem with the prevent setting occurs I add for example an additional folder c:\Windows\Wallpaper\LogonImage\picture.jpg and because of this change and disabling the prevent settings the custom image from the gpo occurs.

      2. Adam Fowler says:

        I’m a bit confused on the workaround – if it doesn’t work for newly imaged PCs without changing the GPO path, do we have to keep changing that path on a daily basis?

  11. Fred Tsui says:

    On my computer I had a LockScreen_Z folder not _P. There were four files in there and when I deleted all four images and rebooted, the lockscreen changed.

  12. Brian Hoyt says:

    I have a possibly related issue. I don’t have any GPO in place to affect lock screen behavior. Yet on my Win 10 Edu 1703 (latest cumulative) machines it is showing the little red text “settings managed” on lock screen configuration. Spotlight is not even an available option. It seems like is disabled but I can’t figure out why?

  13. Nicholas Triplet says:

    Is there any update on this issue?

    1. The secondary issue where you have to change the image path to get lock screen to work has not been fixed as of yet.

  14. Rich-GL says:

    We had to delete the content of the folder

    “C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18\ReadOnly\LockScreen_P”

    You have to do this with system rights (e.g. by using “psexec -ids cmd.exe”).

    During locking the workplace (WIN+L), the pictures are recreated in this folder and the lockscreen turns from solid coloured (blue) to the lockscreenimage value in Policies.

  15. Winyl says:

    I add to the issue list: NOT working/broken Spotlight on boot/login screen.
    Used to work in Anniversary Update.
    Since I installed CrU boot screen shows default pic like right plane wing, beach cave etc. can be changed by Picture option. But Spotlight and Slideshow do not work on boot screen, although they work on Lock Screen nicely. And I have the switch “Show lock screen on sign-in screen”. IMHO there should be another switch there labeled “Show lock screen on boot screen”.

    1. I’ve been seeing that as well. I will check for known issues…or file a bug as needed. Thanks!

      1. winyl says:

        I figured that out. There is a registry key HKCM/Software/Microsoft/Windows/CurrentVession/Authentication/LogonUI/Creative. There is dword key “LockScreenOptions” which in CrU is zero. When you set it to 4 Spotlight shows nicely on boot screen. But Delivery Optimization package/ot Lock Screen pack with change that “LockScreenOptions” value back to zero whenever Spotlight pic changes or or option on LockScreen settings is set Spotlight form whatever it was earlier. Check it out. Is there a reg value controling this behaviour? Or there are two Content Delivery packages one changing the value, and one not?

        1. winyl says:

          There are User IDs like S-15-21-USERID “lockScreenOptions” is in Creative key. Delivery Optimization manager is changing the value thru backgrundTaskHost.exe. This backgrundTaskHost.exe is in fact changing a lot of registry values,hmm.

  16. CASper says:

    This is NOT just a GPO problem. We have no GPOs setting anything related to personalization. We haven’t even updated our (Win7) minimum security GPOs to include Win10 options.

    I run an elevated script when the first Admin logs in that deletes the cache images, renames the caveman image and replaces it with our own image so it becomes the default. Users are perfectly able to change it as they please. No registry entry changes, and no forcing anything.

    Aaannd it still doesn’t work. I am getting a blank, blue screen for both the lock screen and the login screen. The Lock Screen panel has the “*some settings are hidden or managed by your organization” message. (They aren’t.) It shows the correct image in preview, and the picture does not appear greyed out (but it’s hard to tell). If the “Show Windows background picture on the sign-in-screen” setting is turned off, then the lock screen shows the correct image, but the login screen is still just blue. Re-enabling that setting returns to all blue screens.

    Also, if I make a copy of the image to another location and browse to the image from the Lock Screen settings, the preview turns grey with the spinning dots and never completes.

    This shouldn’t be this complicated.

  17. This is still broken in 1709 (Build 16299.15). Policy values are applying to the registry, and the wallpaper image we are trying to use (a local file in C:\ProgramData) is accessible and valid. We use the same .jpg as default wallpaper, and that policy setting works correctly.

    We see a solid color background until we clear the LockScreen_P folder as suggested in an earlier comment. Then we see a default background image, not the one we want.

    1. Was this machine an upgrade from 1703 that was already experiencing the issue, or is it a clean installation of 1709?

      1. It was a clean install of 1709.

        1. Best option since this is a clean install is to use feedback hub and start a report on this for 1709. Make sure to upload screenshots of the preview screen in Settings, expected vs actual. This will alert the product group to issues new to 1709 and start the ball rolling on investigations.

          Once I have more information I will post a 1709 focused blog.

  18. Av says:

    it’s still broken on v1703 with 10/2017 patch.
    nothings of the above is working.
    been working on this silly thing for days!!!

    seems that 2 and a half years after win10 release, it’s still not ready for organisations when some customization are needed

    1. Definitely frustrating for something that should be simple. Did the system (or systems) have the issue before the May or August updates? In an OU with Block inheritance or a local user profile it still fails?

  19. Tristan Colo says:

    I have the Creators update clean installed on version 1709, and am persisting to have this issue. I actually didn’t start having this issue until the most recent Creators update!

    Tried your solutions but they did not work.

    Just FYI

    1. Good to know – Curious to know how it works without any domain policies in play?

    2. Alexandru Vinerean says:

      I have the same problem as Tristan. On 1703 everything was working without any problems, after the users upgraded to 1709 the lock screen image is gone. I’ve tried everything what I could find on the internet, but nothing fixed the issue. Thanks Microsoft 😀

  20. Diana Rollings says:

    11/27/17 The lock screen feature on my Windows 10 isn’t showing the “Like or not a fan” feature. And is not changing
    picture. It’s been stuck on the same picture for a few days. Last time it happened….as soon as I googled the problem it
    began to function properly. Hope it does this again. Can you fix?

    1. That is a function of the “Spotlight” option under lock screen settings which is can be thought of as Cloud content. Meaning sometimes the feed for that information could be down. I have seen this on my personal system in the last week or so and also am seeing some issues in the Windows forums. It is quite possible that its something on our side. One thing to try is to go to Start and type in “Maintenance Tasks” and select Perform system maintenance tasks. This quick troubleshooter may kick any tasks that are stuck, or run some self healing tasks that could resolve this issues. If not, try toggling between Picture and Spotlight to see if that helps.

  21. Rabieta says:

    Buenos dias,

    The following steps worked for us from a newly sysprepped image that WAS NOT restarted until after the steps below were taken. You will need a WinPE boot usb or cd and know simple DOS commands. We have the “Force a specific default lock screen and logon image” and “Prevent changing lock screen and logon image” set to Enabled, although I believe those GPOs are ignored.

    1. Rename the desired JPG image to “img100.jpg”.

    2. Boot the newly-imaged computer into WinPE.

    3. Navigate to “C:\Windows\Web\Screen\” and rename the existing JPG named “img100.jpg” to “img106.jpg”,
    then copy the desired JPG image to this location. From the command prompt:
    • Cd C:\Windows\Web\Screen
    • Ren img100.jpg img106.jpg

    4. Navigate to “C:\Windows\WinSXS\amd64_microsoft-windows-t..nbackgrounds-client_31bf3856ad364e35_10.0.16299.15_none_0002ef866a96301a\”
    and rename the existing JPG named “img100.jpg” to “img106.jpg”, then copy the desired JPG image to this location.
    • Cd C:\Windows\WinSXS\amd64_microsoft-windows-t..nbackgrounds-client_31bf3856ad364e35_10.0.16299.15_none_0002ef866a96301a
    • Ren img100.jpg img106.jpg

    5. Delete the following folders:
    • C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18\*.* The “S-1-15-18” MUST be present. DO NOT DELETE. From the command prompt:
    • Del /q /s C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18\ReadOnly
    • Any other folders inside C:\ProgramData\Microsoft\Windows\SystemData\. Again, DO NOT DELETE the “S-1-15-18” folder.
    You will need to navigate to the folder and do a “DIR” command to see if there are any other folders to delete.

    To recap the steps, from the WinPE command prompt:
    Cd C:\Windows\Web\Screen
    Ren img100.jpg img106.jpg
    Cd C:\Windows\WinSXS\amd64_microsoft-windows-t..nbackgrounds-client_31bf3856ad364e35_10.0.16299.15_none_0002ef866a96301a
    Ren img100.jpg img106.jpg
    Del /q /s C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18\ReadOnly
    Del /q /s C:\ProgramData\Microsoft\Windows\SystemData\[SID folder]

    If you already have a wim image you can simply mount it with DISM and do the steps above manually without having to use WinPE. If using Ghost, you can modify the gho image from Ghost Explorer.

    For computers that are already deployed, you can create a one-time logon script that performs the above steps and runs with SYSTEM credentials, although it might be easier to use SCCM, BigFix, etc. to do this for you.

Skip to main content