How to Deploy a Custom Lock Screen Wallpaper with Microsoft Intune (Win32 & PowerShell)

In-Depth Guide: Deploying a Lock Screen Wallpaper via Intune

Key Point
You will deliver a lock screen image and apply it with a configuration profile. Use a Win32 app to copy the image and a Custom OMA-URI profile to enforce it.

1. Prepare Your Files

You need two files:

• LockScreen.jpg
  Your chosen image file. Pick a resolution that fits most screens (e.g., 1920×1080 or 3840×2160).
• Set-LockScreen.ps1
  A PowerShell script that:
  • Creates a secure folder for the image.
  • Copies the image into that folder.
  • Sets the Windows policy to use that image.

Example script:

# Set-LockScreen.ps1

# Variables
$destFolder = “C:\Windows\LockScreen”
$imageFile = “LockScreen.jpg”
$fullImagePath = Join-Path $destFolder $imageFile
$regKeyPath = “HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization”

# 1. Create folder if missing
if (-not (Test-Path $destFolder)) {
    New-Item -Path $destFolder -ItemType Directory -Force | Out-Null
}

# 2. Copy image
Copy-Item -Path (Join-Path $PSScriptRoot $imageFile) `
          -Destination $fullImagePath -Force

# 3. Ensure registry key
if (-not (Test-Path $regKeyPath)) {
    New-Item -Path $regKeyPath -Force | Out-Null
}

# 4. Set lock screen path
Set-ItemProperty -Path $regKeyPath `
                 -Name “LockScreenImage” `
                 -Value $fullImagePath

Notes on the script

• $PSScriptRoot points to where the script and image live.
• The folder C:\Windows\LockScreen is owned by SYSTEM, so only SYSTEM can write there.
• The registry key under Policies ensures Group Policy won’t overwrite your setting.

2. Package as a Win32 App

Intune does not natively deliver scripts plus files without packaging. The Win32 app wrapper solves this.

1. Download the Win32 Content Prep Tool from Microsoft.
2. Run:

IntuneWinAppUtil.exe `
  -c <source_folder> `
  -s Set-LockScreen.ps1 `
  -o <output_folder>

• holds LockScreen.jpg and Set-LockScreen.ps1.
  • The tool outputs Set-LockScreen.intunewin.
• In Intune (Microsoft Endpoint Manager admin center):
  • Go to Apps > Windows apps.
  • Click Add and choose Windows app (Win32).
  • Upload your .intunewin file.
  • Set Install command:

powershell.exe -ExecutionPolicy Bypass -File .\Set-LockScreen.ps1

• (Optional) Set Uninstall command to remove the registry value and image.
  • Configure requirements:
    • OS: Windows 10 1809 or later.
    • Device must be Azure AD joined or Hybrid joined.
  • Assign to your device group.

3. Create the Custom Configuration Profile

This profile tells Windows to use the registry-defined image for the lock screen.

1. In Intune, go to Devices > Configuration profiles.
2. Click + Create profile.
3. Choose:
   1. Platform: Windows 10 and later.
   1. Profile type: Custom.
4. Under Configuration settings, click Add:
   1. Name: LockScreenImage CSP
   1. OMA-URI:
      ./Device/Vendor/MSFT/Policy/Config/Desktop/Personalization/LockScreenImage
   1. Data type: String
   1. Value:
      C:\Windows\LockScreen\LockScreen.jpg
5. Assign to the same device group as the Win32 app.

4. Deployment Sequence

1. Win32 app deploys first:
   1. Installs the image and sets the registry policy.
2. Configuration profile applies next:
   1. Calls the CSP which reads the registry policy.
   1. Windows updates the lock screen accordingly.

Devices check for new apps and policies every 60 minutes by default.

5. Validate the Deployment

1. Check script output
   On a client PC, open Event Viewer > Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin. Look for success events for your Win32 app.
2. Inspect registry
   Run in PowerShell:

Get-ItemProperty -Path “HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization” `
                -Name LockScreenImage

Ensure the value matches C:\Windows\LockScreen\LockScreen.jpg.

• Generate a policy report

gpresult /h “%UserProfile%\Desktop\GPReport.html”

Open the report and search for LockScreenImage. Confirm it appears under Personalization.

• Lock the screen
  Press Win+L. You should see your image.

6. Troubleshooting Tips

• Image not changing
  • Confirm the Win32 app installed without errors.
  • Ensure the config profile is assigned and shows Succeeded in Intune.
• Access denied copying file
  • Verify your script runs as SYSTEM (Intune does this by default).
  • Check folder permissions on C:\Windows\LockScreen.
• Policy overridden
  • Local or domain Group Policy may block this CSP.
  • Check for conflicting GPO settings under Computer Configuration > Administrative Templates > Control Panel > Personalization.
• Devices offline
  • Ensure devices have internet and can reach Intune service endpoints.
  • Manual sync via Settings > Accounts > Access work or school > Info > Sync.

By following these steps, your managed Windows devices will all display the same lock screen image.