Re: Something similar
Having had something highly similar, although without the screensaver, well, initially.
A user of a military system, on a military network, had been issued a computer for his exclusive usage. While running my weekly vulnerability scan, I took note of that week's systems that stubbornly refused to accept their patches and lined up my work for the afternoon, as the LAN/WAN and PC shops were short staffed and everything had to be patched by end of week.
So, after wading through a few boxes remotely, repairing WSUS, SMS, etc, I come along to one box that had zero bytes free on an HD that was both recently imaged and quite generous for the image.
Run the remove clear all temp script, still pretty full, run the clear old uninstall patch script, still bloody full. Check user profile size, most of the drive!
Running a dir /s > listing.txt and parsing to see if there were some odd temps that were missed by the usual scripts revealed an extensive stash in My Pictures - many, uniquely named to suggest pre-teen pornographic imagery.
At that point, it became a matter for the military police, who received a copy of listing.txt and a short report.
Whereupon a helpful SCCM push changed his screensaver to display the imagery from My Pictures.
We averaged one per year in the theater.
All could have avoided prosecution by simply keeping their filth off of government computers and leaving them on their personal computers, which were prohibited from touching government networks.
Our CERT ran annual "porn scans", as did CENTCOM. Something all users were briefed on before they were allowed to sign for their new accounts.
Mindbogglingly dim!
Biting the hand that feeds IT
