Setting Desktop Background for All Users with Configuration Profiles

[sforney]

I am attempting to set a custom desktop background for all users through Configuration Profiles, and it is working. However, it is locking the desktop backgrounds, and I am unable to change it once it is set. There is an option in the Configuration Profile to lock the desktop background, and I do not have it selected, but it seems to be locking it anyway. Users need to be able to change the background after it is set.

I am deploying the background image into a folder in the root directory, and simply setting the background to it using a configuration profile. Is there a better way to do this? Any ideas on why it is locked, when that option isn't selected? The only way I've been able to change the desktop background is to remove the configuration profile from the computer, then reimage it completely.

[djwojo]

I have been using a package to deploy the background picture same as you, then using this modified python script to set it, due to the same lock out you brought up.
Graham Gilbert GitHub

So far, so good, but the lockouts need to be fixed in config profiles. Just because we set a feature, doesn't mean we should lock the rest!

[andrew_nicholas · Accepted solution]

I went the non-profile method and just created a custom package that drops our background into /Library/Desktop Pictures and use a post install script to update ownership and replace the DefaultDesktop.jpg link in CoreServices. This makes it the same for all users but still lets them change it if they want.

Script for Reference:
chown root:wheel /Library/Desktop Pictures/Your_Wallpaper.jpg
ln -fs /Library/Desktop Pictures/YourWallPaper.jpg /System/Library/CoreServices/DefaultDesktop.jpg

[RobertHammen]

Configuration Profiles: Like MCX, but different. There's no "Once" functionality (or Often), it's all-or-nothing. So yeah, in this case, a script is the best approach.

[mm2270]

You can get "Once" functionality if you use Tim Sutton's mcxToProfile tool and use the right flags. I was not previously aware of this and also thought that Profiles meant it was all or nothing. But Tim doesn't recommend doing the Often setting for Config Profiles because they give you very inconsistent behavior.

[kirkmshaffer]

We do what @andrew.nicholas does - rather than using MCX or Config Profiles, we just replace DefaultDesktop.jpg with our own image. The added bonus is you get that as the "blurry" background for the login screen as well. So if you have a large logo, or widely used main color, the login screen will be recognizable.

[georgecm12]

I, too, finally gave up on trying to set the desktop picture via script, and I'm now just replacing the symlink to DefaultDesktop.jpg.

(For good measure, I'm also replacing /Library/Caches/com.apple.desktop.admin.png and setting it read-only, so that it always uses the same image.)

[gachowski]

Yep,

I think if you want to change it pragmatically you might have to use python and Apple APIs... I gave up too and just have Casper install the new image with the same name over the old one. ( I did it for X.9 so not 100% sure)

C

[apizz]

+1 @georgecm12

[bentoms]

If only this FR was implemented already.

[sforney]

@andrew.nicholas That seems to work just as I was hoping! Really wish the Configuration Profile worked for this, though. Using Composer to monitor system file changes, I was able to capture this as a package with the background image itself and implement it into my imaging.

[andrew_nicholas]

@sforney Glad to hear it!

[Yager]

Does anyone have this script working for El Capitan? We get "operation not permitted" errors on the second line (even when running manually via terminal).

Thanks!

[andrew_nicholas]

@Yager

In El Capitan it becomes slightly more complicated but it just involves changing the name of the file being pointed to.

#!/bin/sh

osVers=$(sw_vers -productVersion | awk -F. '{print $2}')
picLoc="/path/to/picture"

#For El Capitan update the default wallpaper by replacing file the symlink points to
#For everything else, just replace the symlink

#Replace the Default Picture
if [[ $osVers == 11 ]]; then

    mv /Library/Desktop Pictures/El Capitan.jpg /Library/Desktop Pictures/El Capitan.bak.jpg
    mv "$picLoc" /Library/Desktop Pictures/El Capitan.jpg

elif [[ $osVers -lt 10 ]]; then

    #Replace the Default Desktop Link
    ln -fs "$picLoc" /System/Library/CoreServices/DefaultDesktop.jpg

fi

-Andrew

[emily]

I think I built out or Desktop Background setup using Composer. I just want it there day one; I don't want to force people to always use it (though some do!).

[cbrewer]

One note about Andrew's script - if you run it more than once on a computer, you may wipe out the .bak copy and replace it with $picLoc.

To avoid, use something like this for the 10.11 portion...

if [[ ${osVers} -eq 11 ]]; then
  if [ ! -f /Library/Desktop Pictures/El Capitan.bak.jpg ];then
    echo "Coping /Library/Desktop Pictures/El Capitan.jpg as El Capitan.bak.jpg"
    mv /Library/Desktop Pictures/El Capitan.jpg /Library/Desktop Pictures/El Capitan.bak.jpg
  else
    echo "/Library/Desktop Pictures/El Capitan.bak.jpg already exists"
  fi
  ln -sf "$picLoc" /Library/Desktop Pictures/El Capitan.jpg
fi

[sidneimoreira]

I like the solution you provided andrew.nicholas , but SIP is preventing me to change the link on CoreServices.
ln -fs /Library/Desktop Pictures/YourWallPaper.jpg /System/Library/CoreServices/DefaultDesktop.jpg will show a 'operation not permitted' when running manually and I suppose the same reason it won't run in our deployment.
Am I missing a step on this? Any help is appreciated. Thanks!

[andrew_nicholas]

@sidneimoreira the link method won't work from 10.11 on, so a simple solution is to just alter the default file called. The post is dated, but you should really just need to alter it by adding cases for 10.12/10.13/etc...

[ChrisK]

how can I undo the command

ln -fs /Library/Desktop Pictures/YourWallPaper.jpg /System/Library/CoreServices/DefaultDesktop.jpg

in macOS High Sierra and El Capitan?

just updated the devices possible to an higher OS and trashed those not update-able! :)