We have a Windows Server 2012 R2 remote desktop deployment, with a session collection consisting of 6 session hosts. We also use Office365 and DirSync to enable single sign on with ADFS running also.
I have been informed that AD has an attribute called thumbnail photo, that is synced to office 365. By all accounts, this should mean a user can have the same profile image in office 365 and active directory.
My issue is that server 2012 does not seem to display a user's AD photo anywhere. It remains as the default blank image. I am able to change the image once logged in, but as soon as I log off and back on, the image resets to the default again.
I cannot find any GPOs that are locking down this features, so am firstly confused as to why the image resets, and secondly, why this account image does not populate AD, as the account I am using is the domain account.
Is it possible for these to be linked, allowing a user to log onto the server, change their image, have it populate to AD, and then sync to 365?
Further Discovery
I have done a bit more digging, and found that when you set an account picture, there is a registry key at: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AccountPicture\Users. There are then subkeys set for each user with their SID as the key name. By default, users only have read access. I gave users write access, and when I change the account image, it creates entries in that key, Image200, Image240, Image40, Image448 and Image96.
All of these have data values of C:\Users\Public\AccountPictures\Users_SID\{some_GUID}-imagexxx.jpg where xxx is the corresponding number to the name of the entry. These images are proteced operating system files, so I had to uncheck that option to see them. As soon as I log out, this folder is deleted.
I don't know if this is perhaps a temporary location for account images?
Best Answer
The thumbnail photo is not really related to the users profile as such.
It is a property that was added with Exchange2010 to allow for a central, manageable repository for user pictures within outlook.
As it was quickly determined that you don't want your IT department to be responsible for hundreds of user photos (you're bringing back bad memories of my first 'sysadmin' job here!) there are quite a few tools out there that allow for the users to upload their own image.
This requires some minor permission tweaking in AD (nothing that could pose a security issue).
You might want to google "AD photo upload".