通过PowerShell设置本地用户头像失败问题排查

问题背景 #

执行下方PowerShell脚本后，图片已成功下载到指定路径，但注销/重新登录后本地用户（非AD/AAD账户）的头像仍未更新。

function Set-ProfilePicture {
    param (
        [string]$ImageURL = "https://website.com/assets/images/favicons/icon-square.png"
    )
    try {
        # Get current user info
        $currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent()
        $currentUsername = $currentUser.Name.Split('\')[-1]
        $currentUserSID = $currentUser.User.Value
        
        Write-Host "Setting profile picture..." -ForegroundColor Yellow
        
        # Create basic paths
        $picturePath = "C:\ProgramData\Microsoft\User Account Pictures\$currentUsername.png"
        
        # Download the image
        try {
            Invoke-WebRequest -Uri $ImageURL -OutFile $picturePath -UseBasicParsing
        }
        
        # Set basic registry entries
        $registryPath = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\AccountPicture\Users\$currentUserSID"
        
        # Create the path if needed
        if (-not (Test-Path $registryPath)) {
            New-Item -Path $registryPath -Force | Out-Null
        }
        
        # Set the main image paths - simplest possible approach
        Set-ItemProperty -Path $registryPath -Name "Image192" -Value $picturePath -Type String -Force
        Set-ItemProperty -Path $registryPath -Name "Image448" -Value $picturePath -Type String -Force
        
        # Restart the User Profile Service - this seems to be essential
        $service = Get-Service -Name "ProfSvc" -ErrorAction SilentlyContinue
        if ($service) {
            Restart-Service -Name "ProfSvc" -Force -ErrorAction SilentlyContinue
            Start-Sleep -Seconds 2
        }
        
        # Notify Windows
        rundll32.exe user32.dll, UpdatePerUserSystemParameters
        
        Write-Host "Profile picture has been set." -ForegroundColor Green
        Write-Host "Note: System restart recommended for changes to take effect." -ForegroundColor Cyan
    }
    catch {
        Write-Host "Error setting profile picture: $($_.Exception.Message)" -ForegroundColor Red
    }
}

问题原因 #

1. 权限不足：C:\ProgramData\Microsoft\User Account Pictures目录默认仅允许SYSTEM和管理员组写入，普通用户下载的图片可能因权限问题无法被系统读取。
2. 注册表项不完整：本地账户需要配置全尺寸的头像注册表项（如Image32、Image40、Image96等），仅设置Image192和Image448无法覆盖所有系统场景。
3. 服务重启无效：当前用户登录状态下重启ProfSvc服务不仅需要管理员权限，还可能导致用户配置未被正确加载。
4. 本地账户缓存未更新：本地用户的头像实际存储在%USERPROFILE%\AppData\Local\Microsoft\Windows\AccountPictures目录，且系统会生成对应的哈希值注册表项，原脚本未处理这部分内容。

修复后的脚本 #

function Set-LocalUserProfilePicture {
    param (
        [Parameter(Mandatory=$true)]
        [string]$ImageURL
    )

    try {
        # 获取当前用户信息
        $currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent()
        $currentSID = $currentUser.User.Value
        $userProfilePath = [Environment]::GetFolderPath('UserProfile')
        $accountPicsPath = Join-Path $userProfilePath "AppData\Local\Microsoft\Windows\AccountPictures"
        
        # 创建账户图片目录（如果不存在）
        if (-not (Test-Path $accountPicsPath)) {
            New-Item -Path $accountPicsPath -ItemType Directory -Force | Out-Null
        }
        
        # 下载图片到用户私有目录
        $localImagePath = Join-Path $accountPicsPath "$currentSID.png"
        Invoke-WebRequest -Uri $ImageURL -OutFile $localImagePath -UseBasicParsing
        
        # 设置文件权限（确保系统能读取）
        $acl = Get-Acl $localImagePath
        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("NT AUTHORITY\SYSTEM","Read","Allow")
        $acl.AddAccessRule($rule)
        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Users","Read","Allow")
        $acl.AddAccessRule($rule)
        Set-Acl $localImagePath $acl
        
        # 注册表路径
        $regPath = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\AccountPicture\Users\$currentSID"
        if (-not (Test-Path $regPath)) {
            New-Item -Path $regPath -Force | Out-Null
        }
        
        # 设置全尺寸头像注册表项
        $imageSizes = @("Image32", "Image40", "Image48", "Image96", "Image192", "Image200", "Image240", "Image448")
        foreach ($size in $imageSizes) {
            Set-ItemProperty -Path $regPath -Name $size -Value $localImagePath -Type String -Force
        }
        
        # 生成并设置头像哈希值（系统验证需要）
        $hash = (Get-FileHash $localImagePath -Algorithm SHA256).Hash.ToLower()
        Set-ItemProperty -Path $regPath -Name "LastHash" -Value $hash -Type String -Force
        
        # 通知系统更新UI
        rundll32.exe user32.dll, UpdatePerUserSystemParameters 1, True
        
        Write-Host "头像设置完成，请注销后重新登录生效。" -ForegroundColor Green
    }
    catch {
        Write-Host "设置失败：$($_.Exception.Message)" -ForegroundColor Red
    }
}

使用说明 #

1. 以管理员身份运行PowerShell（避免权限问题）。
2. 执行命令：Set-LocalUserProfilePicture -ImageURL "你的图片链接"。
3. 注销当前用户并重新登录，头像即可更新。

内容的提问来源于stack exchange，提问作者Shad0w1