On Sun, 24 Jun 2018 03:09:29 -0400, Paul wrote:
I already showed a picture which proves even Administrator has no access.
http://img4.imagetitan.com/img.php?image=18_systemdata.jpg
PSexec can give you access.
https://s22.postimg.cc/flgec4cqp/psexec.gif
Hi Paul,
Thanks for that hint on how to view that special directory,
where I wouldn't have asked how if it was obvious.
Following your advice, I proved there is a "Lockscreen_0" there!
http://img4.imagetitan.com/img.php?image=18_lockscreen01.jpg
So that's one more of the many locations related to the lock screen photo.
C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-*\ReadOnly\LockScreen_0\
For the record, for others to follow, PSExec is documented he
https://docs.microsoft.com/en-us/sysinternals/downloads/psexec
I saved it to the software archive location:
C:\software\os\util\sysinternals\pstools\PSTools.z ip
Unzipped it created:
C:\software\os\util\sysinternals\pstools\PSTools\.
Renaming and moved it to:
C:\app\os\util\sysinternals\pstools\
Also copied the 64-bit psexec executable into the $PATH:
C:\Windows\System32\PsExec64.exe
Started a powershell as admin:
RMB-Start Windows PowerShell (Admin)
Started a command prompt in psiexec as admin:
PS psexec64 -hsi powershell
This popped up a "nt authority\system" proved with a "whoami" comamnd:
PS whoami
nt authority\system
Changed to the desired directory:
PS cd C:\ProgramData\Microsoft\Windows\SystemData\
List what is in the directory (which isn't much):
PS dir
Directory: C:\ProgramData\Microsoft\Windows\SystemData\
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 6/6/2018 8:50 PM S-1-5-18
d----- 6/4/2018 3:11 PM S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-1001
Hmmm... what is that 30-digit number we both x'd out for privacy?
I went another level deep:
PS cd S-1-5-21-*
PS dir
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 6/23/2018 4:29 AM ReadOnly
PS cd ReadOnly
PS dir
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 6/23/2018 4:29 AM LockScreen_O
This proves that a LockScreen_0 is located he
http://img4.imagetitan.com/img.php?image=18_lockscreen01.jpg
All these references refer to that LockScreen_0 folder containing the
lock-screen images.
https://mergy.org/2016/05/fixing-the-windows-10-pre-login-background-screen/
https://www.tenforums.com/customization/4988-w10-b10041-lock-screen-image-location-2.html
https://answers.microsoft.com/en-us/windows/forum/windows_10-start/unable-to-change-lockscreen-image/4036ab1d-20e8-42a7-b384-d82e2eaeda78
https://answers.microsoft.com/en-us/windows/forum/windows_10-other_settings/windows-10-default-system-lock-screen-location-so/4b746f72-4275-4916-8985-b9fd037b853f
https://superuser.com/questions/1208076/whats-the-source-of-those-daily-changing-locked-screen-wallpapers-on-windows-10
All of which imply that lock-screen images are temporarily saved there.
--
(RMB === right mouse button)