Separate lock screen and desktop wallpaper bases

docs/release-0.6.7.md

@@ -0,0 +1,17 @@
+# SGU Credential Provider 0.6.7
+
+Esta versión separa la imagen de la pantalla de bloqueo de la base utilizada
+para generar el escritorio personalizado.
+
+- `darkblue-lockscreen.jpg` contiene únicamente el fondo azul institucional,
+  sin logotipo ni datos personales.
+- `darkblue.jpg` continúa como base del escritorio de cada sesión y conserva el
+  logotipo oficial integrado.
+- El logo de escritorio se reduce nuevamente y se desplaza ligeramente hacia
+  arriba, sin interferir con el saludo central.
+- El instalador, la GPO clásica, `PersonalizationCSP` y los paquetes de servidor
+  y cliente utilizan explícitamente el archivo correspondiente a cada función.
+- Linux continúa usando sólo la base de escritorio personalizada.
+
+No se modifican la autenticación, los perfiles locales ni las reglas de
+enrolamiento.

docs/welcome-wallpaper.md

@@ -1,13 +1,15 @@
 # Fondo de bienvenida personalizado
 
-El enrolamiento instala un fondo base azul que ya contiene el logotipo blanco
+El enrolamiento instala dos fondos base azules. El escritorio personalizado usa
-oficial de Universidad La Salle México en la esquina inferior derecha, con un
+`assets/branding/darkblue.jpg`, que contiene el logotipo blanco oficial de
-margen interior que lo mantiene separado de los bordes, las familias `Indivisa Text Sans` y
+Universidad La Salle México, pequeño y elevado en el sector inferior derecho.
-`Indivisa Text Serif`, y un generador local. El logotipo está horneado en
+La pantalla de bloqueo usa `assets/branding/darkblue-lockscreen.jpg`, que sólo
-`assets/branding/darkblue.jpg`: el generador no carga, redimensiona ni compone
+contiene el fondo azul y nunca muestra el logo. También instala las familias
-otro logo durante el inicio de sesión. La GPO de equipos
+`Indivisa Text Sans` y `Indivisa Text Serif`, y un generador local. El logotipo
+está horneado únicamente en la base de escritorio: el generador no carga,
+redimensiona ni compone otro logo durante el inicio de sesión. La GPO de equipos
 `SGU - Windows client experience` ejecuta el generador al abrir cada sesión y
-mantiene el fondo base en la pantalla de bloqueo.
+mantiene la base limpia independiente en la pantalla de bloqueo.
 
 Windows no conoce todavía la identidad que se autenticará mientras muestra la
 pantalla previa al inicio de sesión. Por ello, esa pantalla utiliza el fondo base

scripts/Install-CredentialProvider.ps1

@@ -38,6 +38,7 @@ $interactiveLogonPolicyPath = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\P
 $accountPictureSourcePath = Join-Path $PublishPath 'branding\user.png'
 $accountPictureDirectory = Join-Path $env:ProgramData 'Microsoft\User Account Pictures'
 $welcomeWallpaperSourcePath = Join-Path $PublishPath 'branding\darkblue.jpg'
+$welcomeLockScreenSourcePath = Join-Path $PublishPath 'branding\darkblue-lockscreen.jpg'
 $welcomeWallpaperScriptSourcePath = Join-Path $PublishPath 'branding\Set-SguWelcomeWallpaper.ps1'
 $welcomeFontsSourcePath = Join-Path $PublishPath 'branding\fonts'
 $welcomeWallpaperDirectory = Join-Path $env:ProgramData 'SGU\Branding'
@@ -128,6 +129,7 @@ function Install-DefaultAccountPicture {
 
 function Install-WelcomeWallpaperAssets {
     if (-not (Test-Path -LiteralPath $welcomeWallpaperSourcePath -PathType Leaf) -or
+        -not (Test-Path -LiteralPath $welcomeLockScreenSourcePath -PathType Leaf) -or
         -not (Test-Path -LiteralPath $welcomeWallpaperScriptSourcePath -PathType Leaf)) {
         return $false
     }
@@ -135,6 +137,8 @@ function Install-WelcomeWallpaperAssets {
     New-Item -ItemType Directory -Path $welcomeWallpaperDirectory -Force | Out-Null
     Copy-Item -LiteralPath $welcomeWallpaperSourcePath `
         -Destination (Join-Path $welcomeWallpaperDirectory 'darkblue.jpg') -Force
+    Copy-Item -LiteralPath $welcomeLockScreenSourcePath `
+        -Destination (Join-Path $welcomeWallpaperDirectory 'darkblue-lockscreen.jpg') -Force
     Copy-Item -LiteralPath $welcomeWallpaperScriptSourcePath `
         -Destination (Join-Path $welcomeWallpaperDirectory 'Set-SguWelcomeWallpaper.ps1') -Force
     if (Test-Path -LiteralPath $welcomeFontsSourcePath -PathType Container) {
@@ -358,5 +362,6 @@ catch {
     SystemPasswordProviderPreserved = $true
     WelcomeWallpaperAssetsInstalled =
         (Test-Path -LiteralPath (Join-Path $welcomeWallpaperDirectory 'darkblue.jpg') -PathType Leaf) -and
+        (Test-Path -LiteralPath (Join-Path $welcomeWallpaperDirectory 'darkblue-lockscreen.jpg') -PathType Leaf) -and
         (Test-Path -LiteralPath (Join-Path $welcomeWallpaperDirectory 'Set-SguWelcomeWallpaper.ps1') -PathType Leaf)
 }

scripts/New-SguBootstrapPackages.ps1

@@ -143,6 +143,8 @@ Copy-RequiredFile -Source (Join-Path $repositoryRoot 'assets\branding\lasalle-ma
     -Destination (Join-Path $clientRoot 'payload\credential-provider\branding\user.png')
 Copy-RequiredFile -Source (Join-Path $repositoryRoot 'assets\branding\darkblue.jpg') `
     -Destination (Join-Path $clientRoot 'payload\credential-provider\branding\darkblue.jpg')
+Copy-RequiredFile -Source (Join-Path $repositoryRoot 'assets\branding\darkblue-lockscreen.jpg') `
+    -Destination (Join-Path $clientRoot 'payload\credential-provider\branding\darkblue-lockscreen.jpg')
 Copy-RequiredFile -Source (Join-Path $PSScriptRoot 'Set-SguWelcomeWallpaper.ps1') `
     -Destination (Join-Path $clientRoot 'payload\credential-provider\branding\Set-SguWelcomeWallpaper.ps1')
 foreach ($fontName in $welcomeFontNames) {
@@ -238,6 +240,8 @@ Copy-RequiredFile -Source (Join-Path $PSScriptRoot 'Set-SguWelcomeWallpaper.ps1'
     -Destination (Join-Path $serverContentTarget 'welcome-wallpaper\Set-SguWelcomeWallpaper.ps1')
 Copy-RequiredFile -Source (Join-Path $repositoryRoot 'assets\branding\darkblue.jpg') `
     -Destination (Join-Path $serverContentTarget 'welcome-wallpaper\darkblue.jpg')
+Copy-RequiredFile -Source (Join-Path $repositoryRoot 'assets\branding\darkblue-lockscreen.jpg') `
+    -Destination (Join-Path $serverContentTarget 'welcome-wallpaper\darkblue-lockscreen.jpg')
 foreach ($fontName in $welcomeFontNames) {
     Copy-RequiredFile -Source (Join-Path $repositoryRoot "assets\branding\fonts\$fontName") `
         -Destination (Join-Path $serverContentTarget "welcome-wallpaper\fonts\$fontName")

scripts/Set-SguDomainComputerPolicies.ps1

@@ -5,7 +5,8 @@ param(
     [string]$DomainController = $env:COMPUTERNAME,
     [string]$EventCollectorFqdn,
     [string]$WelcomeWallpaperScriptPath = 'C:\ProgramData\SGU\Branding\Set-SguWelcomeWallpaper.ps1',
-    [string]$WelcomeWallpaperBasePath = 'C:\ProgramData\SGU\Branding\darkblue.jpg'
+    [string]$WelcomeWallpaperBasePath = 'C:\ProgramData\SGU\Branding\darkblue.jpg',
+    [string]$WelcomeLockScreenBasePath = 'C:\ProgramData\SGU\Branding\darkblue-lockscreen.jpg'
 )
 
 $ErrorActionPreference = 'Stop'
@@ -113,14 +114,14 @@ $policies = @(
     # The machine GPO remains the authority for every interactive session. The
     # local payload lets the first desktop render without depending on SMB.
     @{ Key = $runPolicyKey; Name = 'SGUWelcomeWallpaper'; Type = 'String'; Value = $welcomeWallpaperCommand },
-    @{ Key = $personalizationPolicyKey; Name = 'LockScreenImage'; Type = 'String'; Value = $WelcomeWallpaperBasePath },
+    @{ Key = $personalizationPolicyKey; Name = 'LockScreenImage'; Type = 'String'; Value = $WelcomeLockScreenBasePath },
     @{ Key = $personalizationPolicyKey; Name = 'NoChangingLockScreen'; Type = 'DWord'; Value = 1 },
 
     # Windows 11 Pro can ignore the legacy lock-screen policy even though it is
     # present in the registry. PersonalizationCSP provides the same local image
     # to Pro while remaining harmless on Enterprise and LTSC editions.
-    @{ Key = $personalizationCspKey; Name = 'LockScreenImagePath'; Type = 'String'; Value = $WelcomeWallpaperBasePath },
+    @{ Key = $personalizationCspKey; Name = 'LockScreenImagePath'; Type = 'String'; Value = $WelcomeLockScreenBasePath },
-    @{ Key = $personalizationCspKey; Name = 'LockScreenImageUrl'; Type = 'String'; Value = $WelcomeWallpaperBasePath },
+    @{ Key = $personalizationCspKey; Name = 'LockScreenImageUrl'; Type = 'String'; Value = $WelcomeLockScreenBasePath },
     @{ Key = $personalizationCspKey; Name = 'LockScreenImageStatus'; Type = 'DWord'; Value = 1 },
     @{ Key = $cloudContentPolicyKey; Name = 'DisableWindowsSpotlightFeatures'; Type = 'DWord'; Value = 1 },
     @{ Key = $cloudContentPolicyKey; Name = 'DisableWindowsSpotlightOnLockScreen'; Type = 'DWord'; Value = 1 }
@@ -176,6 +177,6 @@ $linkEnabled = $link -and (
     PolicyCount = $configuredPolicies.Count
     EventCollector = $EventCollectorFqdn
     WelcomeWallpaperCommand = $welcomeWallpaperCommand
-    LockScreenImage = $WelcomeWallpaperBasePath
+    LockScreenImage = $WelcomeLockScreenBasePath
     Policies = [pscustomobject]$configuredPolicies
 }

tests/ClientEnrollmentScripts.Tests.ps1

@@ -83,4 +83,15 @@ Describe 'SGU Windows client enrollment scripts' {
         (Get-Content -LiteralPath $computerPolicyScriptPath -Raw) |
             Should Match "Name = 'HideFastUserSwitching'; Type = 'DWord'; Value = 1"
     }
+
+    It 'separates the clean lock screen base from the branded desktop base' {
+        $installerSource = Get-Content -LiteralPath $credentialProviderInstallerPath -Raw
+        $policySource = Get-Content -LiteralPath $computerPolicyScriptPath -Raw
+        $packageSource = Get-Content -LiteralPath $packageScriptPath -Raw
+        $installerSource | Should Match 'darkblue-lockscreen\.jpg'
+        $packageSource | Should Match 'darkblue-lockscreen\.jpg'
+        $policySource | Should Match "LockScreenImage.*WelcomeLockScreenBasePath"
+        $policySource | Should Match "LockScreenImagePath.*WelcomeLockScreenBasePath"
+        $policySource | Should Match "LockScreenImageUrl.*WelcomeLockScreenBasePath"
+    }
 }

tests/WelcomeWallpaper.Tests.ps1

@@ -137,8 +137,8 @@ Describe 'Welcome wallpaper with AD metadata' {
                 }
             }
             $lowerRightWhitePixels = 0
-            for ($x = 1225; $x -lt 1525; $x += 2) {
+            for ($x = 1260; $x -lt 1510; $x += 2) {
-                for ($y = 805; $y -lt 930; $y += 2) {
+                for ($y = 740; $y -lt 860; $y += 2) {
                     $pixel = $bitmap.GetPixel($x, $y)
                     if ($pixel.R -gt 220 -and $pixel.G -gt 220 -and $pixel.B -gt 220) {
                         $lowerRightWhitePixels++
@@ -152,4 +152,23 @@ Describe 'Welcome wallpaper with AD metadata' {
             $bitmap.Dispose()
         }
     }
+
+    It 'keeps the lock screen base free of the desktop logo' {
+        $bitmap = [Drawing.Bitmap]::FromFile((Join-Path $repositoryRoot 'assets\branding\darkblue-lockscreen.jpg'))
+        try {
+            $whitePixels = 0
+            for ($x = 0; $x -lt $bitmap.Width; $x += 4) {
+                for ($y = 0; $y -lt $bitmap.Height; $y += 4) {
+                    $pixel = $bitmap.GetPixel($x, $y)
+                    if ($pixel.R -gt 220 -and $pixel.G -gt 220 -and $pixel.B -gt 220) {
+                        $whitePixels++
+                    }
+                }
+            }
+            ($whitePixels -lt 10) | Should Be $true
+        }
+        finally {
+            $bitmap.Dispose()
+        }
+    }
 }