Info Windows 11 (probably 10 too) stores custom lock screen images in most bizarre place (IMO)

[mikeymikec]

A customer wanted me to completely remove an image that had been set as their Windows lock screen (by someone else allegedly, not a Windows Spotlight image); I've never had this request before, so time to learn something new.

Changing the lock screen setting is easy enough through Settings > Personalisation > Lock Screen, but one slightly odd thing is that Windows holds on to the image that had been set so I had to track down where it was being stored.

Searching for this information yielded little in the way of useful information because all the search results were based on Windows Spotlight being enabled, so I pulled out Sysinternals Process Monitor and filtered for filesystem traffic.

I would have thought that custom lock screen images would be somewhere in %appdata% / %localappdata% because that's where spotlight puts it, but no.

The location:
C:\ProgramData\Microsoft\Windows\SystemData\<user SID>\ReadOnly\LockScreen_A

To make matters worse, I think it's the SystemData folder that has some truly YOU SHALL NOT PASS! filesystem privileges and even LockScreen_A has custom user privileges set, I ended up taking ownership of the LockScreen_A folder, deleted all the images (all variations on the image that needed to be deleted, it looked like Windows had saved several copies of the same image but with different image dimensions), job done. There was also a LockScreen_Z folder with the Windows default lock screen image in.

I understand that the lock screen image is a per-user setting so it needs to be stored on a per-user basis, but if nothing is wrong with the %localappdata%...localdeliverymanager folder for spotlight image, why do user-set lock screen images have to be outside the user's folder?

I tried a few shortcuts to finding the information I needed like searching the user's folder for jpegs or saving a theme file then reading the contents of the theme file but apparently lock screen prefs aren't stored in the theme file?? Weird.

I just checked my own LockScreen folders (I've got Spotlight enabled in Windows) and it turns out that despite Windows Spotlight data for the lock screen being stored in one place, it does indeed save the current lockscreen image to this LockScreen folder. Nothing like a bit of data duplication!

Surely it would have been simpler to specify a allusers-writable location and store all current lockscreen images in there? Given that one can hardly argue that it's "private" data since anyone can switch on a Windows box, click on any user, not sign in and see that user's current lock screen image...

IMO it's super-cute when Microsoft creates a folder called 'ReadOnly' though; it reminds me of some Microsoft Edge metadata folder that is labelled something like 'DO NOT TOUCH!'... it makes me think of a teenager storing their totally-not-porn in a folder on the desktop... 'KEEP OUT!'

(I can't actually find that Edge folder I mentioned right now, maybe it in was pre-Chromium Edge?)

 

[Jimminy]

Must have been some mighty naughty pictures.

 

[mikeymikec]

Must have been some mighty naughty pictures.

It was porn, yes Allegedly a prank perpetrated by some builders who have access to the computer. I think this is probably the case since I doubt that the customer has even the foggiest idea how to change the lock screen image.

 

[ZoeAndersen]

Had an interesting challenge recently that might be worth sharing. A customer wanted me to completely remove a custom lock screen image set by someone else on their Windows machine. The usual method of changing the lock screen image through Settings > Personalization > Lock Screen didn't work because Windows kept holding onto the old image. I found out that Windows stores custom lock screen images in a pretty obscure location: C:\ProgramData\Microsoft\Windows\SystemData\<user SID>\ReadOnly\LockScreen_A. It was a bit tricky because the SystemData folder had really strict permissions, and I had to take ownership of the folder to delete the images. Windows had saved several versions of the image with different dimensions, which was odd. There's also a LockScreen_Z folder with the default Windows lock screen image.

 

[PingSpike]

IIRC (old man ancient memories) Windows 95 stored the startup and shutdown images (It is now safe to turn off your computer...) in fake .sys files that were just renamed bitmaps so this unnecessary obfuscation isn't without precedent.

Knowing modern Microsoft they were storing lock screen ads there and didn't want anyone to easily screw with it.