Requiem for a Screensaver

When I arrived at work this morning, I was forwarded a urgent demand from the corporate communications office. The presentation computer by the elevator lobby near the executives was showing an old screen-saver using the old company logo. I had seen something similar in on the displays in the south lobby a week or so back, so I knew what they were talking about.
The machines by the elevator lobby were using a restricted domain account. Since the computer was purposed to display information, the screen-saver was disabled in group policy. If the screen-saver wasn’t even enabled, how could the user have seen a screen-saver, I asked.
So I set out to google for a solution. I found that if no one is logged in, the screen-saver settings in hkey_users\.default\control panel\desktop will be used. I thought that had to be the solution. No one was logged in, and that caused a screen-saver to run. It was a good theory, but it turned out the .default registry settings use logon.scr for the screen-saver. That isn’t the screen-saver that was observed.
I searched some more, I found out I’d forgotten a key piece of information. The Default user account which is used as the template when new accounts are made does not store the default registry information in hkey_users\.default. That is for the service account. Instead the registry is stored in ntuser.dat.
When the computer was ghosted, the last act prior to sysprep is to copy the profile used to configure everything into the default profile. Because these systems are exceedingly old, the ntuser.dat is set to run the old old screen-saver. Any new account will be created expecting to use this old screen-saver. With domain accounts, the screen-saver is changed by group policy. But there is an issue with local accounts, and also I suspect and issue when the user profile does not load correctly, and it uses a default profile instead.
I updated the ntuser.dat on the systems for which I have responsibility. I also edited the registry to remove the existing configuration pointing to the old old screen-saver.