How to Customize Windows Login and Lock Screen Using Group Policy (GPO)

First, ensure you have the Group Policy Management Console available on your domain controller or administrative workstation. On Windows Server 2022+, install RSAT tools if not already present.

Add-WindowsCapability -Online -Name Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0

Alternatively, install via Server Manager by navigating to Add Roles and Features > Features > Remote Server Administration Tools > Role Administration Tools > Group Policy Management Tools.

Create a new Group Policy Object specifically for login and lock screen customization. This keeps your customizations organized and easy to manage.

Open Group Policy Management Console and navigate to your target Organizational Unit. Right-click the OU and select Create a GPO in this domain, and Link it here...

Name the GPO something descriptive like "Corporate Login Lock Screen Policy" and click OK. Right-click the newly created GPO and select Edit.

Navigate to: Computer Configuration > Policies > Administrative Templates > System > Logon

Find and double-click Always use custom logon background. Set it to Enabled and click OK.

Create the required directory structure and deploy your custom login background image. The image must meet specific requirements for proper display.

On each target machine (or via GPO file deployment), create the following directory:

mkdir "C:\Windows\System32\oobe\info\backgrounds"

Copy your custom background image to this location and rename it to backgroundDefault.jpg. The image specifications are critical:

• Format: JPG only
• Resolution: 1920x1080 pixels
• File size: Under 256KB
• Aspect ratio: 16:9

You can automate this deployment using a startup script in your GPO. Navigate to Computer Configuration > Policies > Windows Settings > Scripts > Startup and add a batch script:

@echo off
if not exist "C:\Windows\System32\oobe\info\backgrounds" mkdir "C:\Windows\System32\oobe\info\backgrounds"
copy "\\domain.com\sysvol\domain.com\scripts\backgroundDefault.jpg" "C:\Windows\System32\oobe\info\backgrounds\backgroundDefault.jpg" /Y

Set up a custom lock screen image that will be enforced across all domain computers. This is separate from the login screen background.

In the Group Policy Editor, navigate to: Computer Configuration > Policies > Administrative Templates > Control Panel > Personalization

Find and enable Force a specific default lock screen and logon image. In the options section, specify the path to your lock screen image:

C:\Windows\Web\Screen\corporate-lock.jpg

Create a startup script to deploy the lock screen image:

copy "\\domain.com\sysvol\domain.com\scripts\corporate-lock.jpg" "C:\Windows\Web\Screen\corporate-lock.jpg" /Y

The lock screen image should also follow the same specifications as the login background: JPG format, 1920x1080 resolution, under 256KB.

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" -Name "LockScreenImage"

Configure legal notices that appear before users can log in. This is crucial for corporate compliance and security policies.

Navigate to: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options

Configure these two policies:

1. Interactive logon: Message title for users attempting to log on

Set this to something like: AUTHORIZED ACCESS ONLY

2. Interactive logon: Message text for users attempting to log on

Set this to your legal notice, for example:

This system is for authorized users only. All activities are monitored and recorded. Unauthorized access is prohibited and may result in prosecution under applicable laws. By continuing, you acknowledge and consent to monitoring.

Lock down personalization settings to prevent users from overriding your corporate branding and security configurations.

Configure these policies under Computer Configuration > Policies > Administrative Templates > Control Panel > Personalization:

1. Enable Prevent changing lock screen and logon image

2. Enable Prevent changing desktop background

3. Navigate to User Configuration > Policies > Administrative Templates > System > User Profiles and enable Prevent changing lock screen camera and slide show

Additionally, you can hide the personalization settings entirely by enabling Prohibit access to Control Panel and PC settings under User Configuration, though this may be too restrictive for most environments.

Link your GPO to the appropriate Organizational Units and force immediate policy application across your domain.

In Group Policy Management Console, ensure your GPO is linked to the correct OUs containing your target computers. You can also link it at the domain level if you want it to apply to all computers.

To force immediate policy application on target machines, run these commands:

gpupdate /force
shutdown /r /t 0

For remote policy updates across multiple machines, use PowerShell:

Invoke-GPUpdate -Computer "Computer1","Computer2" -Force -RandomDelayInMinutes 0

You can also schedule the policy update for all computers in an OU:

Get-ADComputer -Filter * -SearchBase "OU=Workstations,DC=domain,DC=com" | ForEach-Object { Invoke-GPUpdate -Computer $_.Name -Force }

gpresult /h C:\temp\gpo-results.html

Open the HTML report and verify your custom login/lock screen policies appear under "Computer Configuration" with "Winning GPO" showing your policy name.

Verify your implementation works correctly and resolve common problems that may occur during deployment.

Test the complete login experience:

1. Restart a target machine completely

2. Verify the legal notice appears first

3. Confirm the custom login background displays

4. Log in and lock the screen (Windows + L) to test the lock screen image

Common troubleshooting steps:

If images don't appear, check these registry values:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "UseOEMBackground"
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" -Name "LockScreenImage"

Check Group Policy event logs for errors:

Get-WinEvent -LogName "Microsoft-Windows-GroupPolicy/Operational" | Where-Object {$_.LevelDisplayName -eq "Error"} | Select-Object -First 10

If policies aren't applying, verify the computer account has the correct permissions and the GPO is linked properly. Use gpresult /r for a quick overview of applied policies.