Windows lets you replace the default logon background, enforce a specific lock screen image, and display a legal notice before credentials are entered - all through Group Policy rather than per-device configuration. This tutorial creates a dedicated GPO named something like Corporate Login Lock Screen Policy, enables Always use custom logon background under Computer Configuration > Policies > Administrative Templates > System > Logon, and deploys spec-compliant images via startup scripts sourced from SYSVOL. You will add the interactive logon message title and text under Security Options, then lock personalization so standard users cannot change what you deploy.
The custom logon background policy runs only on Pro, Enterprise, and Education editions - not on Home or LTSC. Images fail silently when they are the wrong format or too large, so every image must be JPG, 1920x1080, and under 256KB. This change affects production sign-in behavior across many machines, so back up existing GPOs and note current defaults before you start, and test against a single machine before linking the policy broadly.
Before you start
What you will learn
- You will build a single Group Policy Object that deploys a branded custom logon background, a custom lock screen image, and a legal logon notice to every domain-joined computer, then lock down personalization so users cannot override it.
- An enforced login and lock screen keeps corporate identity consistent and, more importantly, presents the legal warning banners many compliance and security frameworks require before authentication. Configure it once through GPO and it applies across the domain without touching each machine.
Requirements
- Domain Administrator (or delegated rights to create, link, and edit GPOs on the target OU), plus local administrator access on a machine with the Group Policy Management Console. You also need write access to the SYSVOL scripts share to stage the image files.
- Domain Administrator or a user with delegated Group Policy create/link/edit permissions on the target OU
- Local Administrator on the domain controller or admin workstation running GPMC
Good to know
- Roughly 45-60 minutes for initial configuration, plus reboot and testing time on target machines.
- Steps reference Windows Server 2022+ for GPMC/RSAT and target Windows 11/10 Pro, Enterprise, and Education clients.
Quick answer
Create one GPO linked to your target OU, enable `Always use custom logon background` under Computer Configuration > System > Logon, deploy a spec-compliant JPG via a SYSVOL startup script, set the lock screen and legal notice policies, lock down personalization, then run gpupdate and reboot a test machine to confirm.
Computer Configuration > Policies > Administrative Templates > System > Logon > Always use custom logon backgroundStep-by-step tutorial
8 stepsInstall Group Policy Management tools
Ensure the Group Policy Management Console is available to create and edit GPOs.
Server Manager > Add Roles and Features > Features > Remote Server Administration Tools > Role Administration Tools > Group Policy Management ToolsOn your domain controller or a domain-joined admin workstation, confirm the Group Policy Management Console (GPMC) is installed. On Windows Server 2022+, install the RSAT Group Policy Management Tools if they are missing:
Run the PowerShell command in the Command block from an elevated prompt.
Alternatively, install via Server Manager > Add Roles and Features > Features > Remote Server Administration Tools > Role Administration Tools > Group Policy Management Tools.
You can also install GPMC on Windows 11 Pro/Enterprise workstations to manage GPOs remotely without signing in to the domain controller. After installation, open the Run dialog (Windows + R), type gpmc.msc, and press Enter.
Add-WindowsCapability -Online -Name Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0Run PowerShell as Administrator. If the capability reports as already installed or present, GPMC is ready and no action is needed.
Create and configure the login screen GPO
Create a dedicated GPO and enable the custom logon background policy.
Group Policy Management Editor > Computer Configuration > Policies > Administrative Templates > System > Logon > Always use custom logon backgroundIn GPMC, expand your domain and navigate to the target Organizational Unit (OU) that contains your computer accounts. Right-click the OU and select Create a GPO in this domain, and Link it here...
Name the GPO descriptively, for example Corporate Login Lock Screen Policy, and click OK. Right-click the new GPO and select Edit to open the Group Policy Management Editor.
Navigate to Computer Configuration > Policies > Administrative Templates > System > Logon. Double-click Always use custom logon background, set it to Enabled, and click OK.
This policy works only on Windows 11/10 Pro, Enterprise, and Education editions. Home and LTSC editions ignore it due to personalization restrictions. Keeping login/lock screen settings in a dedicated GPO makes them easier to manage and roll back.
Prepare and deploy the custom login background image
Place a spec-compliant background image on all target machines.
Group Policy Management Editor > Computer Configuration > Policies > Windows Settings > Scripts > StartupThe custom logon background must live at C:\Windows\System32\oobe\info\backgrounds\backgroundDefault.jpg on each machine. The specifications are strict:
- Format: JPG only
- Resolution: 1920x1080 pixels
- File size: under 256 KB
- Aspect ratio: 16:9
Store the master image in the SYSVOL share for centralized deployment, then automate the copy with a computer startup script. In the editor, go to Computer Configuration > Policies > Windows Settings > Scripts > Startup and add the batch script shown in the Command block. Adjust the \\domain.com\... path to match your domain's SYSVOL scripts folder.
@echo off
if not exist "C:\Windows\System32\oobe\info\backgrounds" mkdir "C:\Windows\System32\oobe\info\backgrounds"
copy "\\domain.com\sysvol\domain.com\scripts\backgroundDefault.jpg" "C:\Windows\System32\oobe\info\backgrounds\backgroundDefault.jpg" /YReplace domain.com and the SYSVOL path with your own domain. Files over 256 KB or in the wrong format make the custom background fail silently. Verify the file size with a dir command on a target machine.
Configure the custom lock screen image
Enforce a branded lock screen separate from the logon background.
Group Policy Management Editor > Computer Configuration > Policies > Administrative Templates > Control Panel > Personalization > Force a specific default lock screen and logon imageThe lock screen image is configured independently of the logon background. In the editor, navigate to Computer Configuration > Policies > Administrative Templates > Control Panel > Personalization.
Double-click Force a specific default lock screen and logon image, set it to Enabled, and in the options section enter the local path to your lock screen image, for example:
C:\Windows\Web\Screen\corporate-lock.jpg
Deploy the image to that path with a startup script (add it under Scripts > Startup as in the previous step) using the copy command in the Command block. The lock screen image follows the same specifications: JPG, 1920x1080, under 256 KB.
copy "\\domain.com\sysvol\domain.com\scripts\corporate-lock.jpg" "C:\Windows\Web\Screen\corporate-lock.jpg" /YConfirm the policy applied by reading the registry value: Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" -Name "LockScreenImage". Copy the image to the target machine before the policy references it, or the lock screen may fall back to default.
Add legal notice and security messages
Display a required legal warning before users can log on.
Group Policy Management Editor > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security OptionsConfigure a logon banner that users must acknowledge before entering credentials. In the editor, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options.
Set the following two policies:
- Interactive logon: Message title for users attempting to log on - for example:
AUTHORIZED ACCESS ONLY - Interactive logon: Message text for users attempting to log on - for example:
> This system is for authorized users only. All activities are monitored and recorded. Unauthorized access is prohibited and may result in prosecution under applicable laws. By continuing, you acknowledge and consent to monitoring.
Enable each policy, enter the value, and click OK.
Both the title and text must be set for the banner to display. Keep the message concise but complete - users click OK before proceeding, which adds a step to every login. Confirm the wording with your legal or compliance team.
Prevent users from changing login and lock screen settings
Lock down personalization so users cannot override corporate branding.
Group Policy Management Editor > Computer Configuration > Policies > Administrative Templates > Control Panel > PersonalizationPrevent users from overriding your branding and security settings. Under Computer Configuration > Policies > Administrative Templates > Control Panel > Personalization, enable:
- Prevent changing lock screen and logon image
- Prevent changing desktop background
Then navigate to User Configuration > Policies > Administrative Templates > System > User Profiles and enable Prevent changing lock screen camera and slide show.
Optionally, hide personalization entirely by enabling Prohibit access to Control Panel and PC settings under User Configuration, though this is usually too restrictive for most environments.
To exempt executives or specific departments, create a security group, then use GPO security filtering (Scope tab in GPMC, or the Deny Apply group policy permission) to exclude that group from these restrictive policies.
Apply the GPO and force policy updates
Push the policy to target computers and confirm delivery.
Group Policy Management Console > [Domain] > [Target OU] > Linked Group Policy ObjectsIn GPMC, confirm the GPO is linked to the correct OUs that contain your target computers. You can also link it at the domain level to apply to all computers, though a scoped OU link is safer.
To apply immediately on a single machine, run gpupdate /force and then reboot so the computer-side settings take effect (the logon background and lock screen require a restart).
For remote or bulk updates, use the PowerShell commands in the Command block. Invoke-GPUpdate targets named computers; the Get-ADComputer pipeline refreshes every computer in an OU.
# Single machine
gpupdate /force
shutdown /r /t 0
# Named remote machines
Invoke-GPUpdate -Computer "Computer1","Computer2" -Force -RandomDelayInMinutes 0
# All computers in an OU
Get-ADComputer -Filter * -SearchBase "OU=Workstations,DC=domain,DC=com" | ForEach-Object { Invoke-GPUpdate -Computer $_.Name -Force }Replace the SearchBase distinguished name with your own OU and domain components. Invoke-GPUpdate requires the Active Directory and Group Policy PowerShell modules and appropriate remote permissions. Verify delivery with gpresult /h C:\temp\gpo-results.html and confirm your policy appears as the Winning GPO.
Test and troubleshoot common issues
Verify the full login experience and fix silent failures.
Fully restart a test machine and validate the end-to-end experience:
- Confirm the legal notice appears first and must be acknowledged.
- Confirm the custom login background displays.
- Sign in, then press Windows + L to confirm the custom lock screen image appears.
If images do not appear, check the underlying registry values and the Group Policy Operational log using the commands in the Command block. Silent failures are most often caused by images over 256 KB, the wrong format, or a missing file at the expected path. If policies are not applying at all, verify the GPO is linked correctly and use gpresult /r for a quick overview of applied policies.
# Confirm background/lock screen registry values
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "UseOEMBackground"
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" -Name "LockScreenImage"
# Check Group Policy errors
Get-WinEvent -LogName "Microsoft-Windows-GroupPolicy/Operational" | Where-Object {$_.LevelDisplayName -eq "Error"} | Select-Object -First 10Before rolling out broadly, document the default Windows behavior and prepare a rollback plan (disable or unlink the GPO and remove the deployed images). Confirm image specifications before deployment - oversized or wrong-format files fail without any visible error.
Confirming the Login and Lock Screen Policy Is Applied
After you reboot a test machine, you should see the full branded experience in the correct order: the legal notice dialog first, then your custom logon background with the credential prompt, and - after signing in and pressing Windows + L - your enforced lock screen image. All three confirm the GPO is being received and every component is deployed correctly.
These are computer-side settings, so they take effect only after a reboot (or a full gpupdate /force followed by a restart). If the notice appears but the background does not, the policy is applying and the image deployment or file specs are the problem - treat those as two separate checks rather than assuming the whole GPO failed.
To confirm delivery independently of what you see on screen, generate a Group Policy Results report with gpresult /h C:\temp\gpo-results.html and open it. Under Computer Configuration, your policy name should appear as the Winning GPO for the logon and personalization settings. You can also read back the registry values the policies write to verify the machine received them.
- The legal notice appears before logon, the custom logon background and lock screen images display, and the gpresult report lists your GPO as the Winning GPO under Computer Configuration. Registry values UseOEMBackground and LockScreenImage are present and populated.
- The default Windows background shows, images fail silently (often because the file is over 256KB or not a valid 1920x1080 JPG), the legal notice does not appear, or the gpresult report does not list your GPO - pointing to the OU link, edition restriction, or file deployment.
- Shown under Computer Configuration in C:\temp\gpo-results.html when the policy is applying correctly.
- A value of 1 confirms Always use custom logon background reached the machine.
- Confirms the Force a specific default lock screen and logon image policy path was applied.
- File must exist and be under 256KB; oversized or wrong-format images fail silently.
Troubleshooting
Custom logon background does not appear after the GPO applies
Cause: The background image fails the strict specifications (JPG format, 1920x1080 resolution, under 256KB) or is missing from the target path, so Windows falls back silently to the default background.
Confirm the file exists at C:\Windows\System32\oobe\info\backgrounds\backgroundDefault.jpg and check its size with dir. Re-export the image as JPG at 1920x1080, compress it to under 256KB, then redeploy. Verify the policy switch with Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "UseOEMBackground" - it should return 1.
The custom logon background policy has no effect on some machines
Cause: The Always use custom logon background policy works only on Windows 11/10 Pro, Enterprise, and Education editions; Home and LTSC editions ignore it due to personalization restrictions.
Check the edition of the affected machines with Get-ComputerInfo -Property WindowsProductName. Move Home/LTSC devices out of scope or plan an alternative, and reserve this GPO for supported editions.
The GPO does not seem to reach target computers
Cause: The GPO is not linked to the OU containing the computer accounts, the link is disabled, or security filtering is excluding the machines.
In GPMC, confirm the GPO is linked and enabled on the correct OU (or domain). Run gpupdate /force on a target, generate gpresult /h C:\temp\gpo-results.html, and confirm your policy appears as the Winning GPO under Computer Configuration.
Custom lock screen image does not display after reboot
Cause: The image was not copied to the path specified in Force a specific default lock screen and logon image, or the startup script did not run before the policy was read.
Verify the file exists at the configured path (e.g. C:\Windows\Web\Screen\corporate-lock.jpg) and check Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" -Name "LockScreenImage". Reboot once more so the startup script and computer policy both apply, then lock the screen with Windows + L to test.
Policy processing errors but no obvious cause
Cause: Group Policy client-side extensions are failing to process the settings, often logged in the Group Policy Operational event log.
Run Get-WinEvent -LogName "Microsoft-Windows-GroupPolicy/Operational" | Where-Object {$_.LevelDisplayName -eq "Error"} | Select-Object -First 10 to surface errors, then confirm the computer account has read/apply permissions on the GPO and that SYSVOL replication is healthy.
Executives or specific users are blocked from personalizing their machines
Cause: The Prevent changing lock screen and logon image and related lockdown policies apply broadly to everyone in scope.
Create a security group for exempt users or computers and use GPO security filtering to deny the Apply Group Policy permission for that group, so the restrictive policies skip them while branding still applies elsewhere.
Frequently asked questions
Why is my custom logon background not showing after applying the GPO?
The most common cause is an image that does not meet the required specifications or sits in the wrong path. Confirm backgroundDefault.jpg is a JPG at 1920x1080 under 256KB in C:\Windows\System32\oobe\info\backgrounds, and that the UseOEMBackground registry value is 1 after the policy applies.
Does the custom logon background policy work on Windows Home or LTSC editions?
No. The Always use custom logon background policy works only on Windows 11/10 Pro, Enterprise, and Education editions. Home and LTSC editions ignore it due to personalization restrictions.
What are the exact image specifications for backgroundDefault.jpg?
The image must be JPG format, 1920x1080 pixels (16:9 aspect ratio), and under 256KB. Files that are too large or in the wrong format make the custom background fail silently.
How do I exempt certain users or executives from the personalization lockdown?
Create a dedicated security group for the exempt users or computers and apply GPO security filtering. Deny the Apply Group Policy permission for that group on the restrictive GPO so those members keep personalization access while branding still applies to everyone else.
How can I verify the login and lock screen GPO is actually being applied?
Run gpresult /h C:\temp\gpo-results.html on a target machine and open the report to confirm your policy appears as the Winning GPO under Computer Configuration. You can also check the relevant registry values under HKLM:\SOFTWARE\Policies\Microsoft\Windows.
How do I roll back these login and lock screen customizations?
Before deploying, document the default Windows behavior so you have a baseline. To roll back, unlink or delete the GPO (or set each policy to Not Configured), run gpupdate /force, and reboot; then remove the deployed image files if you no longer need them.
