Mananged User Profile Pic

There is a DSCL element that points to the user picture you could likely use in a script, though in my experience its more intended for local accounts than AD accounts. I apply a base icon only at default setup going with a low brow method: remove/move all existing icon pictures and leave only the company default in place. It won't prevent a user from changing it, and it will change when the system upgrades OS, but for a first run method it has worked pretty well.

Edit, this is what you're probably logging for:

#!/bin/sh
dscl . read /Users/[shortname] Picture

we force set our users icons as well... here is the script i use...

#!/bin/sh

# Get Logged in User
loggedInUser=`python -c 'from SystemConfiguration import SCDynamicStoreCopyConsoleUser; import sys; username = (SCDynamicStoreCopyConsoleUser(None, None, None) or [None])[0]; username = [username,""][username in [u"loginwindow", None, u""]]; sys.stdout.write(username + "
");'`

# Delete any Photo currently used.
dscl . delete /Users/$loggedInUser jpegphoto
sleep 1
# Delete File path
dscl . delete /Users/$loggedInUser Picture
sleep 1
# Set New Icon
dscl . create /Users/$loggedInUser Picture "/Library/User Pictures/picture.tif"