Improve domain enrollment and desktop personalization

scripts/Set-SguDomainComputerPolicies.ps1

@@ -3,7 +3,9 @@ param(
     [string]$TargetOuDn = 'OU=Laboratorio,DC=lci,DC=lasalle,DC=mx',
     [string]$GpoName = 'SGU - Windows client experience',
     [string]$DomainController = $env:COMPUTERNAME,
-    [string]$EventCollectorFqdn
+    [string]$EventCollectorFqdn,
+    [string]$WelcomeWallpaperScriptPath = 'C:\ProgramData\SGU\Branding\Set-SguWelcomeWallpaper.ps1',
+    [string]$WelcomeWallpaperBasePath = 'C:\ProgramData\SGU\Branding\darkblue.jpg'
 )
 
 $ErrorActionPreference = 'Stop'
@@ -75,7 +77,11 @@ $interactiveLogonPolicyKey = 'HKLM\Software\Microsoft\Windows\CurrentVersion\Pol
 $accountPicturePolicyKey = 'HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
 $eventForwardingPolicyKey = 'HKLM\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager'
 $auditPolicyKey = 'HKLM\System\CurrentControlSet\Control\Lsa'
+$runPolicyKey = 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'
+$personalizationPolicyKey = 'HKLM\Software\Policies\Microsoft\Windows\Personalization'
 $providerClassId = '{D789CFD8-5AD4-489F-9B83-7EB5D9D09335}'
+$welcomeWallpaperCommand = 'powershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "{0}" -BaseImagePath "{1}"' -f `
+    $WelcomeWallpaperScriptPath,$WelcomeWallpaperBasePath
 $policies = @(
     @{ Key = $dataCollectionKey; Name = 'AllowTelemetry'; Type = 'DWord'; Value = 0 },
     @{ Key = $dataCollectionKey; Name = 'DisableTelemetryOptInSettingsUx'; Type = 'DWord'; Value = 1 },
@@ -99,7 +105,13 @@ $policies = @(
     # Source-initiated Windows Event Forwarding. Kerberos authenticates domain
     # computers to the collector; no SGU password or reusable secret is logged.
     @{ Key = $eventForwardingPolicyKey; Name = '1'; Type = 'String'; Value = "Server=http://${EventCollectorFqdn}:5985/wsman/SubscriptionManager/WEC,Refresh=300" },
-    @{ Key = $auditPolicyKey; Name = 'SCENoApplyLegacyAuditPolicy'; Type = 'DWord'; Value = 1 }
+    @{ Key = $auditPolicyKey; Name = 'SCENoApplyLegacyAuditPolicy'; Type = 'DWord'; Value = 1 },
+
+    # The machine GPO remains the authority for every interactive session. The
+    # local payload lets the first desktop render without depending on SMB.
+    @{ Key = $runPolicyKey; Name = 'SGUWelcomeWallpaper'; Type = 'String'; Value = $welcomeWallpaperCommand },
+    @{ Key = $personalizationPolicyKey; Name = 'LockScreenImage'; Type = 'String'; Value = $WelcomeWallpaperBasePath },
+    @{ Key = $personalizationPolicyKey; Name = 'NoChangingLockScreen'; Type = 'DWord'; Value = 1 }
 )
 
 $powerSettingIds = @(
@@ -151,5 +163,7 @@ $linkEnabled = $link -and (
     LinkEnabled = [bool]$linkEnabled
     PolicyCount = $configuredPolicies.Count
     EventCollector = $EventCollectorFqdn
+    WelcomeWallpaperCommand = $welcomeWallpaperCommand
+    LockScreenImage = $WelcomeWallpaperBasePath
     Policies = [pscustomobject]$configuredPolicies
 }