Index

1. Set desktop background with Intune, but allow modification
2. Push the desktop background from Intune

Set desktop background with Intune, but allow modification

It’s possible to set the desktop background with Intune, very easily. The problem however is let the user changing it afterwards which is not possible. When pushing the desktop background with Intune, changing the background image is greyed out:

The solution is to delete the regkey that is responsible for “locking” the background. Just remove this key, it doesn’t actually remove the background but only removes the lock. Relevant regkey:

1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP\DesktopImagePath

Just remove the property “DesktopImagePath” (create a back-up first of course). If you want to do this for multiple users, you can use this PowerShell script:

1
2
3
4
5
6
7
8
9
$path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP"

$PCSP = Get-ItemProperty $path -Name "DesktopImagePath" -ErrorAction SilentlyContinue

if (!$null -eq $PCSP) {

    Remove-ItemProperty -Path $path -Name "DesktopImagePath" -Force

}

}

if ($false -eq (Test-Path "$env:ProgramData\Microsoft\AllowBackgroundPersonalization")) {

    $scriptfile = New-Item -ItemType Directory -Path "$env:ProgramData\Microsoft\AllowBackgroundPersonalization"

}

If you use the Intune “Scripts” option, it’s possible that the script runs earlier than the desktop background is pushed. Since the scripts runs only once, this script doesn’t have any effect. You could create a scheduled task that runs at every logon to work around the problem:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
$script = {

    $path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP"

$PCSP = Get-ItemProperty $path -Name "DesktopImagePath" -ErrorAction SilentlyContinue

if (!$null -eq $PCSP) {

    Remove-ItemProperty -Path $path -Name "DesktopImagePath" -Force

}

}

if ($false -eq (Test-Path "$env:ProgramData\Microsoft\AllowBackgroundPersonalization")) {

    $scriptfile = New-Item -ItemType Directory -Path "$env:ProgramData\Microsoft\AllowBackgroundPersonalization"

}

$script | Out-File -FilePath "$scriptfile\AllowBackgroundPersonalization.ps1"



$schtaskName = "AllowBackgroundPersonalization"

$schtaskDescription = "Allow changing the background in Intune"

$trigger = New-ScheduledTaskTrigger -AtLogOn

$principal = New-ScheduledTaskPrincipal "NT AUTHORITY\SYSTEM" -RunLevel Highest

$action = New-ScheduledTaskAction -Execute powershell.exe -Argument "-File $scriptfile\AllowBackgroundPersonalization.ps1"

$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries

$null=Register-ScheduledTask -TaskName $schtaskName -Trigger $trigger -Action $action -Principal $principal -Settings $settings -Description $schtaskDescription -Force

Start-ScheduledTask -TaskName $schtaskName

Next step is to push the script by Intune. Since the script is running in system context and getting the regkey from the local system, you can run it in system context:

Push the desktop background from Intune

This is how you push the desktop background by Intune. Go to: https://endpoint.microsoft.com/ Create a new profile:

Fill in an internet-accessible URL: