I'm running a 10.11.3 machine and I'm seeing odd Lock Window behavior.
What I'm trying to accomplish: A custom background image that displays at the FileVault Screen, Login Window, and the lock screen.
For the first two screens, I've been able to successfully change the image to what I want by editing the com.apple.desktop.admin.png under /Library/Caches.
For the lock screen I had to dig to /System/Library/Frameworks/AppKit.framework/Versions/C/Resources/NSTexturedFullScreenBackgroundColor.png and change it to the desired photo. I had to disable SIP to do so.
What is odd: When I lock the machine I get a screenshot of my desktop with a gray film layer on top. If i get the window to re render (I connect an external monitor) while the machine is still locked I get my desired photo like the FileVault and LoginWindow screen.
Looking at console during a screen lock (see attached) I notice that WindowServer generates the desktop screenshot and puts it as the Lock Screen. Is there a way to stop this from happening? Is this why my image is not displaying till a re render happens? Should there be a sleep image for WillPowerOffWithImages / where are those images stored?
Or better yet, is there a better way to handle putting a custom Image on the Lock Screen, FileVault, and Window Login?
Thanks for any information!
@Bongardino I've somewhat given up on trying to get the lock screen to not take a screenshot of the desktop.. I actually didn't need to edit the /System/Library/Frameworks/AppKit.Framework/Versions/C/Resources/NSTexturedFullScreenBackgroundColor.png for the lock screen to change the picture on a re-render too.
I'm putting a Login Window Banner on the Lock screen using this command:
sudo defaults write /Library/Preferences/com.apple.loginwindow LoginwindowText "Your Login Text Here"
I put that script into a policy that runs at login.
You could also get create an extension Attribute to look for your Text:
sudo defaults read /Library/Preferences/com.apple.loginwindow LoginwindowText | grep LoginwindowText | cut -c 23-468
I used the cut -c command to remove everything expect the text i was looking for. You'd want to set up some variables to set what the text should be and what the users text is.