Lockscreen

Install

$targetPath = "$envProgramData\LockScreen"

# 1. Create the folder
try {
    New-ADTFolder -LiteralPath $targetPath
    Write-ADTLogEntry -Message "Folder [$targetPath] created or already present." -Severity 1
}
catch {
    Write-ADTLogEntry -Message "Failed to create folder [$targetPath]: $(Resolve-ADTErrorRecord -ErrorRecord $_)" -Severity 3
    throw
}

# 2. Set folder permissions
try {
    icacls $targetPath /inheritance:r | Out-Null
    icacls $targetPath /grant:r "*S-1-5-32-545:(OI)(CI)(RX)" | Out-Null   # BUILTIN\Users
    icacls $targetPath /grant:r "*S-1-5-18:(OI)(CI)F" | Out-Null          # SYSTEM
    icacls $targetPath /grant:r "*S-1-5-32-544:(OI)(CI)F" | Out-Null     # BUILTIN\Administrators
    if ($LASTEXITCODE -ne 0) {
        throw "icacls returned exit code $LASTEXITCODE"
    }
    Write-ADTLogEntry -Message "Permissions set on [$targetPath]." -Severity 1
}
catch {
    Write-ADTLogEntry -Message "Failed to set permissions on [$targetPath]: $(Resolve-ADTErrorRecord -ErrorRecord $_)" -Severity 3
    throw
}

Invoke-ADTAllUsersRegistryAction -ScriptBlock {
    Set-ADTRegistryKey -LiteralPath 'HKCU\Software\Microsoft\Windows Photo Viewer\Slideshow\Screensaver' -Name 'EncryptedPIDL' -Type String -Value 'FAAfUOBP0CDqOmkQotgIACswMJ0ZAC9DOlwAAAAAAAAAAAAAAAAAAAAAAAAAYAAxAAAAAACDWKlsEiBQUk9HUkF+MwAASAAJAAQA776DWJ22g1ipbC4AAADsQAMAAAACAAAAAAAAAAAAAAAAAAAAO4HtAFAAcgBvAGcAcgBhAG0ARABhAHQAYQAAABgAXgAxAAAAAACDWCJvECBMT0NLU0N+MQAARgAJAAQA776DWNdqg1giby4AAAD0XwAAAAADAAAAAAAAAAAAAAAAAAAAKmINAUwAbwBjAGsAUwBjAHIAZQBlAG4AAAAYAAAA' -SID $_.SID
    Set-ADTRegistryKey -LiteralPath 'HKCU\Software\Microsoft\Windows Photo Viewer\Slideshow\Screensaver' -Name 'Shuffle' -Type DWord -Value 0 -SID $_.SID
    Set-ADTRegistryKey -LiteralPath 'HKCU\Software\Microsoft\Windows Photo Viewer\Slideshow\Screensaver' -Name 'speed' -Type DWord -Value 1 -SID $_.SID
}

Uninstall

$targetPath = "$envProgramData\LockScreen"

try {
    Remove-ADTFolder -Path $targetPath
    Write-ADTLogEntry -Message "Folder [$targetPath] removed." -Severity 1
}
catch {
    Write-ADTLogEntry -Message "Failed to remove folder [$targetPath]: $(Resolve-ADTErrorRecord -ErrorRecord $_)" -Severity 3
    throw
}

Invoke-ADTAllUsersRegistryAction -ScriptBlock {
    Remove-ADTRegistryKey -LiteralPath 'HKCU\Software\Microsoft\Windows Photo Viewer\Slideshow\Screensaver' -Name 'EncryptedPIDL' -SID $_.SID
    Remove-ADTRegistryKey -LiteralPath 'HKCU\Software\Microsoft\Windows Photo Viewer\Slideshow\Screensaver' -Name 'Shuffle' -SID $_.SID
    Remove-ADTRegistryKey -LiteralPath 'HKCU\Software\Microsoft\Windows Photo Viewer\Slideshow\Screensaver' -Name 'speed' -SID $_.SID
}

Policy

NameValue
Enable screen saver (User)Enabled
Force specific screen saver (User)Enabled
Screen saver executable name (User)%Systemroot%\System32\PhotoScreensaver.scr
Password protect the screen saver (User):Enabled
Prevent changing screen saver (User)Enabled
Screen saver timeout (User)Enabled
Seconds: (User)600