Apply lock screen through PersonalizationCSP

docs/welcome-wallpaper.md

@@ -51,6 +51,9 @@ en `%LOCALAPPDATA%\SGU\Wallpapers` y se aplica con la API nativa de Windows.
 La antigua directiva estática de escritorio se elimina para que no sobrescriba
 el archivo individual. La personalización sigue estando gobernada por dominio:
 el comando de inicio y la pantalla de bloqueo pertenecen a la GPO de equipos.
+La GPO configura tanto la directiva clásica como `PersonalizationCSP` y desactiva
+Windows Spotlight en la pantalla de bloqueo, porque Windows 11 Pro puede ignorar
+la ruta clásica aun cuando el valor de registro está presente.
 
 ## Linux
 

scripts/Set-SguDomainComputerPolicies.ps1

@@ -79,6 +79,8 @@ $eventForwardingPolicyKey = 'HKLM\Software\Policies\Microsoft\Windows\EventLog\E
 $auditPolicyKey = 'HKLM\System\CurrentControlSet\Control\Lsa'
 $runPolicyKey = 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'
 $personalizationPolicyKey = 'HKLM\Software\Policies\Microsoft\Windows\Personalization'
+$personalizationCspKey = 'HKLM\Software\Microsoft\Windows\CurrentVersion\PersonalizationCSP'
+$cloudContentPolicyKey = 'HKLM\Software\Policies\Microsoft\Windows\CloudContent'
 $providerClassId = '{D789CFD8-5AD4-489F-9B83-7EB5D9D09335}'
 $welcomeWallpaperCommand = 'powershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "{0}" -BaseImagePath "{1}"' -f `
     $WelcomeWallpaperScriptPath,$WelcomeWallpaperBasePath
@@ -111,7 +113,16 @@ $policies = @(
     # local payload lets the first desktop render without depending on SMB.
     @{ Key = $runPolicyKey; Name = 'SGUWelcomeWallpaper'; Type = 'String'; Value = $welcomeWallpaperCommand },
     @{ Key = $personalizationPolicyKey; Name = 'LockScreenImage'; Type = 'String'; Value = $WelcomeWallpaperBasePath },
-    @{ Key = $personalizationPolicyKey; Name = 'NoChangingLockScreen'; Type = 'DWord'; Value = 1 }
+    @{ Key = $personalizationPolicyKey; Name = 'NoChangingLockScreen'; Type = 'DWord'; Value = 1 },
+
+    # Windows 11 Pro can ignore the legacy lock-screen policy even though it is
+    # present in the registry. PersonalizationCSP provides the same local image
+    # to Pro while remaining harmless on Enterprise and LTSC editions.
+    @{ Key = $personalizationCspKey; Name = 'LockScreenImagePath'; Type = 'String'; Value = $WelcomeWallpaperBasePath },
+    @{ Key = $personalizationCspKey; Name = 'LockScreenImageUrl'; Type = 'String'; Value = $WelcomeWallpaperBasePath },
+    @{ Key = $personalizationCspKey; Name = 'LockScreenImageStatus'; Type = 'DWord'; Value = 1 },
+    @{ Key = $cloudContentPolicyKey; Name = 'DisableWindowsSpotlightFeatures'; Type = 'DWord'; Value = 1 },
+    @{ Key = $cloudContentPolicyKey; Name = 'DisableWindowsSpotlightOnLockScreen'; Type = 'DWord'; Value = 1 }
 )
 
 $powerSettingIds = @(