There is a DSCL element that points to the user picture you could likely use in a script, though in my experience its more intended for local accounts than AD accounts. I apply a base icon only at default setup going with a low brow method: remove/move all existing icon pictures and leave only the company default in place. It won't prevent a user from changing it, and it will change when the system upgrades OS, but for a first run method it has worked pretty well.

Edit, this is what you're probably logging for:

#!/bin/sh

dscl . read /Users/[shortname] Picture

we force set our users icons as well... here is the script i use...

#!/bin/sh



# Get Logged in User

loggedInUser=`python -c 'from SystemConfiguration import SCDynamicStoreCopyConsoleUser; import sys; username = (SCDynamicStoreCopyConsoleUser(None, None, None) or [None])[0]; username = [username,""][username in [u"loginwindow", None, u""]]; sys.stdout.write(username + "

");'`



# Delete any Photo currently used.

dscl . delete /Users/$loggedInUser jpegphoto

sleep 1

# Delete File path

dscl . delete /Users/$loggedInUser Picture

sleep 1

# Set New Icon

dscl . create /Users/$loggedInUser Picture "/Library/User Pictures/picture.tif"