1

possibly dumb question here.

I work at a help desk so I should probably know this but I don't. Yet.

My coworker(s) like to play pranks on me and one set my desktop background to another image and set it to Read-Only. He then tricked me into doing a group policy update and rebooting (during a time where my PC was having legit issues so I thought that's what we were fixing ugh lol) so that it would go through. I assume he possibly set it through Active Directory or something, not exactly sure.

We are all admins within Active Directory so I should be able to change it myself.. if I know how.

When I go to change my desktop background the normal way, it still shows that it is set to the image I set it to before he changed it. So my local computer thinks its something else, so I cannot change it that way.

He has stated that all I have to do to be able to fix it is to find the path to the image (which is stored on his computer, I can access his C drive whenever he is logged into the network if I wanted to, no issue) and change the image from Read Only to Read/Write.

The problem is I don't know how to find the path to the image.

I found this existing forum post here - How could I find out the path to the current desktop image? that suggested a batch file that would return the path to the desktop image.

However, when I run this batch file, it returns the path to the image that my computer thinks the background is set to (the old background) and not the one it is actually set to.

Anyone know a good way to quickly find the path to the image my coworker has set my background to? I would appreciate it, thanks :]

Excellll
  • 12,847
inspiris
  • 11

1 Answers1

1

Your co-worker is lieing to you. The background is set via group policy. It may be applied locally, or it may be applied from the domain controller.

The policy is located here: User Configuration\Administrative Templates\Desktop\Desktop\Desktop Wallpaper.

To find out how the policy is applied you can use resultant set of policy mmc. i.e. rsop.msc it is a tool to see the cumulative set of policies applied to your system. It will show you what this policy is set to on your system and which group policy applied it.

You can then remove the policy and restore your ability to set your own background.

To better insure this doesn’t happen in the future, I would start by adding your user account to the local administrators group and then remove the domain admins group from the local administrators group. This prevents any other admins from accessing your computer remotely.

Next block group policy by denying yourself and SYSTEM write access to C:\Windows\System32\GroupPolicy

And denying yourself and SYSTEM write access to the following registry keys: HKLM\Software\Policies HKCU\Software\Policies HKLM\Software\Microsoft\CurrentVersion\GroupPolicyObjects HKLM\Software\Microsoft\CurrentVersion\Policies HKCU\Software\Microsoft\CurrentVersion\Policies

This will block the ability of your system to apply group policy updates.

Appleoddity
  • 11,970