View Single Post
  #12  
Old June 24th 18, 12:13 PM posted to alt.comp.os.windows-10
Arlen Holder
external usenet poster
 
Posts: 466
Default Photos at start of Win 10

On Sun, 24 Jun 2018 03:09:29 -0400, Paul wrote:

I already showed a picture which proves even Administrator has no access.
http://img4.imagetitan.com/img.php?image=18_systemdata.jpg


PSexec can give you access.
https://s22.postimg.cc/flgec4cqp/psexec.gif


Hi Paul,

Thanks for that hint on how to view that special directory,
where I wouldn't have asked how if it was obvious.

Following your advice, I proved there is a "Lockscreen_0" there!
http://img4.imagetitan.com/img.php?image=18_lockscreen01.jpg

So that's one more of the many locations related to the lock screen photo.
C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-*\ReadOnly\LockScreen_0\

For the record, for others to follow, PSExec is documented he
https://docs.microsoft.com/en-us/sysinternals/downloads/psexec

I saved it to the software archive location:
C:\software\os\util\sysinternals\pstools\PSTools.z ip

Unzipped it created:
C:\software\os\util\sysinternals\pstools\PSTools\.

Renaming and moved it to:
C:\app\os\util\sysinternals\pstools\

Also copied the 64-bit psexec executable into the $PATH:
C:\Windows\System32\PsExec64.exe

Started a powershell as admin:
RMB-Start Windows PowerShell (Admin)

Started a command prompt in psiexec as admin:
PS psexec64 -hsi powershell

This popped up a "nt authority\system" proved with a "whoami" comamnd:
PS whoami
nt authority\system

Changed to the desired directory:
PS cd C:\ProgramData\Microsoft\Windows\SystemData\

List what is in the directory (which isn't much):
PS dir
Directory: C:\ProgramData\Microsoft\Windows\SystemData\
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 6/6/2018 8:50 PM S-1-5-18
d----- 6/4/2018 3:11 PM S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-1001

Hmmm... what is that 30-digit number we both x'd out for privacy?

I went another level deep:
PS cd S-1-5-21-*
PS dir
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 6/23/2018 4:29 AM ReadOnly

PS cd ReadOnly
PS dir
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 6/23/2018 4:29 AM LockScreen_O

This proves that a LockScreen_0 is located he
http://img4.imagetitan.com/img.php?image=18_lockscreen01.jpg

All these references refer to that LockScreen_0 folder containing the
lock-screen images.
https://mergy.org/2016/05/fixing-the-windows-10-pre-login-background-screen/
https://www.tenforums.com/customization/4988-w10-b10041-lock-screen-image-location-2.html
https://answers.microsoft.com/en-us/windows/forum/windows_10-start/unable-to-change-lockscreen-image/4036ab1d-20e8-42a7-b384-d82e2eaeda78
https://answers.microsoft.com/en-us/windows/forum/windows_10-other_settings/windows-10-default-system-lock-screen-location-so/4b746f72-4275-4916-8985-b9fd037b853f
https://superuser.com/questions/1208076/whats-the-source-of-those-daily-changing-locked-screen-wallpapers-on-windows-10

All of which imply that lock-screen images are temporarily saved there.
--
(RMB === right mouse button)
Ads