Known Lock Screen issues with Creator's Update (1703)


Updated 7/7/2017

There are a few open issues with Lock screen setting on Windows 10 Enterprise build 1703 (Creator's Update)

 

Resolved: The first is with the Group Policy setting "Force a specific default lock screen image" under

Computer Configuration\Administrative Templates\Control Panel\Personalization

In many cases trying to enabled, change or update this doesn’t appear to work for new or existing users in the environment.

This will happen if "Prevent changing lock screen and logon image" policy is also enabled.

One of the key indicators of this is when you see the desired lock screen image in Settings under Lock screen as the preview but the controls to change are greyed out.

2017-05-05_11-30-18

Many people have sent me that screen shot and said - "See, that's the image I want to appear!" not noting that since its greyed out it also means the "Prevent" lock screen is in play.  When Prevent is disabled it should look like this:

2017-05-05_11-27-52

 

This issue is fixed in beta builds and an update released last week in May KB4020102

The workaround is to set "Prevent" to Disabled or Not Configured, apply that change and then make the desired updates to "Force".  If there are still issues with Force at this point, test applying it in an OU that blocks inheritance for all other polices to confirm there isn't something else in play.

The "Force" policy does work by default, with no other policies enabled.

 

The second issue is when Animate settings are changed on the system, the Lock Screen will be black. The time and other text will appear normally, the lock screen with work normally, users will just see black instead of the desired picture.

The setting specifically, under Advance System Settings, Settings under Performance - Animate window minimizing and maximizing is unchecked.

2017-05-05_10-12-08

Or when the policy "Do not allow Windows animations" is enabled under

Computer Configuration\Windows Components\Desktop Windows Manager

2017-05-05_10-29-30

The workaround for this one is to not enable the policy or uncheck the setting.

This issue was present in 1607 and fixed with the last February Cumulative update but the issue seems to have returned in 1703 and we're currently investigating it.

 

Additional issues 7/7/2017:

The fix for the first issue implemented new image cache and algorithm.  Initially, when "Prevent..." was applied it would block any changes made to "Force..." policy.  After the May update this has changed and may have some side effects. Some reports I'm seeing are:

  • This is not reproducible 100% of the time.
  • Some machines will work and some will not with the same settings.
  • Resetting the policies to Not Configured and reenabling does not resolve the behavior
  • Some users report this issue without any Group Policies, users not able to change it via Settings
  • Changing the location of the lock screen image on the system may work
  • Lock screen reverts/changes to Cave after resolution change
  • Lock screen behavior is inconsistent when Docked vs Undocked

These symptoms are not all a result of the May update and are not necessarily all the same issue but one issue that we are working on is with the new image cache implementation.  The workaround for this issue is:

  • Copy the image you want to a second path and update the policy with the new path.
  • Update the Last Modify Timestamp of the image referenced in the policy.
  • Backup and delete the folder C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18\ReadOnly\LockScreen_P

Hope that helps!

Comments (37)

  1. HelgeKlein says:

    One incarnation of the black lock screen is well documented on my blog: https://helgeklein.com/blog/2017/02/windows-10-black-lock-screen-citrix-receiver/

    The root cause is Citrix Receiver calling SystemParametersInfo with SPI_SETANIMATION.

  2. HPO says:

    Hi Kimberj,

    The lock screen doesn't apply even with the changes you mentioned above.

    1. Is this Enterprise or Pro and do you see the preview correctly in the Settings app or no change in Settings?

      1. Jeremy D says:

        I'm seeing this on the Education version of 1703. I've reverted the policies you mentioned and the lock screen still doesn't force to the image I specified.

  3. Drew A says:

    All of our 1703 computers are having "Issue 1" I cant get it to work on any of them, using an Enterprise sku and attempted the workaround.

    1. If you put a system in an OU that blocks all policies, and test just setting the "Force" group policy, does that work? I'm hearing reports of additional issue(s) but have not gotten clear repro steps. Blocking all and setting it on the machine locally will clear out any other possible GP issues. If it works locally but fails again when back in a normal OU there's likely another GP in play. I'd love to hear if that helps narrow down the issue.

      1. Drew A says:

        Kimberj,

        We have some enforced policies that I cant disable (and those have nothing to do with personalization), but I placed the user and computer in an ou with block inheritance enabled. I did a gpupdate /force on an existing user, no change. I logged off of that user, logged on as a new user (new to the computer) that user received the proper lock screen. Please note I did not test this with the same user prior to making the new OU and test GPO. Thing is this working for new profiles is great, but I'm looking to push the 1703 update to my general population very soon, and since we are in advertising this is probably going to delay the deployment since we are very brand oriented. Thanks for your help.

  4. Matt Gailer says:

    I only have the "Force a specific default lock screen and logon image" enabled (using an image that is local, not a UNC path) and I have the issue. This worked fine on build 1607, and worked fine on machines that were in-place upgraded from 1607 to 1703. It's only fresh builds that are doing this. Oddly enough, on occasions it works as expected. But mostly it is failing.

    1. For the issues that occur without having "Prevent" enabled - is there any change in behavior between an existing user and a brand new local user account on the machine?

      1. Andreas Björklund says:

        I'm in the same situation for Windows 10 Enterprise. Upgraded to .332 just now, and it doesn't seem to be solved yet. Only have “Force a specific default lock screen and logon image” enabled and it doesn't matter if there is a new or old user logging in for me.

        1. Robert Silva says:

          Windows 10 EDU. Broke on creators update install (through Windows update) and most recent CU doesn't resolve issue in our environment with existing images upgraded to Creators through Windows Update.

        2. Alex Pooley says:

          Issue still exists with build KB4020102 (OS Build 15063.332).

          We are using "Force a specific default lock screen and logon image" to a UNC path.
          Prevent changing lock screen and logon image = Enabled
          Prevent enabling lock screen slide show = Enabled

          No enforced or blocked inheritance within the GPOs

      2. No change between existing user or brand new user. What I have seen is that the custom image will show for 2-3 seconds, and then you see it fade out and it stays on the default logon image. I've just done a 2nd site with a fresh 1703 build, and it's the same result. What's the fix that is mentioned for release on 24th May?

        1. The fix in May was for a specific issue where the Prevent GP was overriding Force GP. That issue has been fixed, but as you can see we're still seeing side issues that appear related. The difficult part is that once the May fix is installed in my lab environment - I am not able to repro the additional side issues. This just means there is a variable(s) out there that needs to be identified... We're investigating issues that persist after the May update.

  5. Jim Molnar says:

    When the Creator Update was applied to my companies Surface Hub, Remote Desktop App (From the Windows Store) stopped working on the Hub. Is this a known issue or repeatable?

    1. I'm checking on our hub - it should still work, afaik.

      1. Just got confirmation that there was an issue that was fixed with June patch released this week(6/27). If the devices are up to date they should be back up and running!

  6. DAllston says:

    My Enterprise 1703 clients, who are fully patched as of 6/15, are still having trouble with the lock screen not working as expected. Is there any updates other then the one posted on May 30th about progress on this? This is the only blocking issue we know of keeping us from rolling this build out company wide.

    1. There are several variations of issues with lock screen. Can you detail what not working as expected means?

      Note - Once a user changes lock screen on their own, Force will not work (Which is why we have the Prevent GP.) User preferences overrule the Force GP in this instance. So if users have changed off of the default lock screen (Cave picture in Windows 10) Force GP will not appear to take effect.

      1. Alan Dooley says:

        Based on that what is the approach to undo the users original setting? Surely it is just removing a reg key in their profile? We are seeing mixed results on machines which are all in the same OU with the same GPOs and I'm wondering if it is because some time ago, pre 1703 they had set their own image...

        1. Hi All - I've updated the article with some additional information. I'm specifically interested if changing the location of the lock screen image file or backing up/deleting the image cache helps mitigate the issue.
          Thanks for all the comments and information around Lock screen issues. I know it is frustrating for something that should be cut and dry to be so fussy (believe me) and we're hammering on this until it works!

          1. Xeraxx says:

            Changing the location of the lock screen image seems to have finally fixed it for me. I also disabled the "Prevent changing lock screen" earlier on but that had no effect by itself. I didn't have to delete that image cache.

          2. Adam Fowler says:

            Hi,
            Had this problem and was directed here. Getting inside that SystemData folder was tricky, so thought I'd just try to change the policy 'Force a specific lock screen and path' to a different location - from a location on C:\ to a DFS share.
            Doing that, running gpupdate and nothing else seems to have fixed it. Locked workstation, and there was our custom image. The modified date of the file wasn't changed, and is still from 2013.
            Hope that helps 🙂

      2. Justin Warner says:

        I'm seeing the same issues here on Win 10 Edu;. I changed policy to remove the "Prevent" GP setting, and only apply the "Force" pointing to an image in the NETLOGON share. Any machine that has installed the 1703 update no longer displays the assigned image. Previous builds across 1507, 1511 and 1607 all seemed to work with both Prevent and Force enabled. Now I can't get it to work at all. Which KBs are relevant to fixing this issue?

      3. Alan Dooley says:

        I currently use both settings - Prevent changing lock screen and logon image and Force a specific default lock screen and logon image. On the most part it does work in 1703 but I still have some clients which don't apply correctly.

        I tried not configuring Prevent changing lock screen and logon image. This then allows the user to change the lock screen image. Interestingly if they change it to something other than 'caves' it changes to what they selected. If you then re-enable 'Prevent changing lock screen and logon image' it forces them back to 'caves' and not to the image you have set via 'Force a specific default lock screen and logon image'

      4. Justin Warner says:

        Additionally, manually setting the desired lock screen has no effect. The "force" setting seems to be ignoring the image I've configured and is just forcing the default image instead. I'm currently running 2017-06 cumulative update on Win 10 Edu 1703.

  7. Fred Tsui says:

    Hi there -

    I'm still not getting the lockscreen to set for either an existing user or a new user.

    I've updated my EDU1703 with the 2017-06 Cumulative Update for 1703 (KB4022725). I've set the image as a local policy. My district AD does not set this. I made sure that users are not prevented from changing the Lockscreen. And nothing changes.

    1. Hrm - Local Policy with a local .jpg file? Are the users local users or domain users? and Force is the only Lock Screen policy set?

      1. Awis13 says:

        Same problem, updated to version 15063.413 and no changes, Lock Screen still wont show, if Show lock screen background picture on the sign in screen is turned on.

      2. Fred Tsui says:

        I'm using png files. The users are domain users and I only modified the setting to force a lockscreen image.

      3. Fred Tsui says:

        I'm using a png. I made sure that I'm only using the Set Lockscreen GPO only. The users are domain users.

      4. Fred Tsui says:

        Sorry if this is the 3rd reply. I don't see my replies show up with a moderation warning so I don't know if they are registering.

        I am using png files. I'm using domain users and Force is the only local policy set

  8. Alan Dooley says:

    Thanks for the workarounds. I edited the metadata on the image referenced in the policy in order to change the modified date. This has resolved it on my 1703 clients which were seeing the issue.

  9. Marcus Rath says:

    Great Kimberj! Thanks for sharing. For me changing the location of the logon image does the success. To be sure I changed both source and destination in the gpo and disabled the two prevent settings.

    best regards,
    Marcus

  10. Marcus Rath says:

    Additional after changing the path and disabling the prevent policies it works, I tried again with a new machine and 1703 version if it works on the new installed machine with the prevent policies and it doesn't work and shows the default windows logon/lock screen. In this case disabling the prevent settings again wasn't enough to get the image from the gpo and I had to change the path of the image on the local system again to work.

    So it seems every time a 1703 client applied the policy with the prevent settings the only way to get the customized gpo logon image after this is to change the destination path in the gpo.

    1. yes - That is a secondary issue with the new image cache handling. To (hopefully) clarify the issues here
      Builds 15063.0 until 15063.332 = Problems with Force+Prevent GPs, fixed in 15063.332
      Builds 15063.332+ = problems with image cache, still being addressed. Workaround is to move the image location.

      Just a quick question for those posting that moving the image works - Are the images stored locally on the client machine or on a network share?
      Thanks!

      1. Marcus Rath says:

        yes Kimberj, the gpo also had an entry to copy the image from a network share to the client computer locally to c:\Windows\Wallpaper and if the problem with the prevent setting occurs I add for example an additional folder c:\Windows\Wallpaper\LogonImage\picture.jpg and because of this change and disabling the prevent settings the custom image from the gpo occurs.

Skip to main content