How to Configure and Deploy Screensaver on Windows with Group Policy

You can enable and configure the same corporate screensaver on all computers in the Active Directory domain. In this post, we will show how to enable a slideshow screensaver with images containing information security rules for users.

Enable and Configure Screensaver Settings on Windows

The first thing you need to do is configure the screen saver settings on the reference Windows computer. Later, we will export the screensaver settings from this computer and apply them to other domain computers using a GPO.

We have prepared several JPG files with images that need to be shown to users on the screensaver. Go to the C:\Users\Public\Pictures folder (public profile files available to all users), create a folder ScreenSaver, and copy your screensaver JPG files to it.

Go to Settings -> Personalization -> Lock Screen (or run the command: ms-settings:lockscreen ) and click Screen Saver Settings.

Select Photos as your screensaver and click Settings (for quick access to the screen saver settings, run the command: control desk.cpl,,@screensaver ). Specify the path to the source folder containing your images.

The following section of the registry contains the screensaver settings HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Photo Viewer\Slideshow\Screensaver. The path to the directory containing the images is specified in encrypted form (Base64) in the EncryptedPIDL registry parameter. Copy the value of the EncryptedPIDL parameter (this value will be used later when you create a GPO with the screensaver settings).

Deploy Screensaver Settings with Group Policy

Copy JPG image files to a shared network folder that can be read by all users. You can use the SYSVOL directory on a domain controller to store image files (in this example \\woshub.loc\SYSVOL\woshub.loc\scripts\ScreenSaver UNC path is used ). Check that the Authenticated User group has read permissions on this folder.

Now you must configure Group Policy to copy image files to users’ computers and enable Windows screensaver.

1. Open the domain Group Policy management snap-in (gpmc.msc), create a new GPO and link it to the OU containing the target user accounts;
2. Edit the GPO and navigate to User Configuration -> Preferences -> Windows Settings -> Folders. Create a new item: New -> Folder. Specify the value %Public%\Pictures\ScreenSaver (this GPP item will create the ScreenSaver folder in the public user profile);
3. Now go to the Files section and create a GPP rule that copies all files from \\woshub.loc\SYSVOL\woshub.loc\scripts\ScreenSaver\* to %Public%\Pictures\ScreenSaver . Use * in the source path to copy all files.
4. Then navigate to the Registry section and select New -> Registry item. Create a new registry parameter with the following settings:Hive: HKEY_CURRENT_USER
   Key path: SOFTWARE\Microsoft\Windows Photo Viewer\Slideshow\Screensaver
   Value name: EncryptedPIDL
   Value type: REG_SZ
   Value date: Copy the EncryptedPIDL parameter value from the reference computer. Go to the Common tab and enable the Remove the item when it is no longer applied option.
   Find out more about using the GPO to deploy registry settings to computers.
5. Then navigate to User Configuration -> Policies -> Administrative Templates -> Control Panel -> Personalization. Enable the policy Force specific screen saver, and specify PhotoScreensaver.scr as its value (by default, Photoscreensaver.scr uses the C:\Users\Public\Pictures\Sample Pictures directory as the source of images for the slide show).
6. Specify the computer idle time in seconds after which the screensaver automatically turns on in Screen Saver Timeout. To automatically lock and password-protect your computer screen, you can also enable the Password Protect Screen option. To lock the screen saver settings, select the Prevent changing screen saver option.

Close the Group Policy Management console and update the GPO settings on the client computers (gpupdate /force). Check that the corporate screen saver, which is in the form of a slide show of pictures, is activated when the computers are not in use.

Use the PowerShell command to view the screen saver settings for the current user:

Get-Wmiobject win32_desktop | where name -match $env:USERNAME

ScreenSaverActive : True
ScreenSaverSecure : False
ScreenSaverTimeout : 60