How are different branding elements applied when multiple brand packages are installed on a device?
Please note: Some of the default package version settings described on this page were introduced in WPSecure Personalization Package version 67.21.1. Please ensure you have installed the latest version from the Microsoft Store.
Personalization packages are created using the WPSecure Personalization Packager (also known as the Windows Branding Tool). This intuitive tool allows you to build an unlimited number of packages, with each package capable of including one, several, or all of the following branding elements:
- Desktop backgrounds
- Lock screen images
- Microsoft Outlook email signatures
- Microsoft Teams background images
- Video screensavers
Beginning with Personalization Packager version 67.21.1, each device supports the installation of up to 12 personalization packages side-by-side.
Version numbers are timestamp-based and increase sequentially: a package created more recently will always have a higher version number than one created earlier (e.g., a package built last week will have a lower version than one built today).
The versioning system is central to how WPSecure manages branding when multiple personalization packages are installed on a single device.
By default, the WPSecure engine applies each branding element (also referred to as a personalization item) from the installed package with the highest version number, overriding the same element type from any packages with lower version numbers.
Key Principle: Selection occurs per branding element type, not per entire package. The engine always chooses the version of each element from the package with the overall highest version number among those containing that element type.
Example: Suppose you create and deploy a new package today (with the highest version number) that includes all supported branding elements:
- Desktop backgrounds
- Lock screen images
- Microsoft Outlook email signatures
- Microsoft Teams background images
- Video screensavers
In this case, all of these branding elements from the new package will automatically take precedence over the corresponding elements in any previously installed packages—solely because the new package has the highest version number.
While the previous example assumed a new package contains all branding element types, not every package includes every type. The WPSecure engine handles this flexibly by selecting per branding element type (also called personalization item).
For each individual branding element type present across the installed packages, the engine selects the version from the installed package with the highest overall version number that actually contains that element type.
Imagine the following packages are installed on a device:
| Package | Version | Creation Date | Desktop Background | Lock Screen | Outlook Signatures | Teams Background | Screensaver |
|---|---|---|---|---|---|---|---|
| A | 20.24.1101.0900 | 2024-11-01 | Yes | No | No | No | No |
| B | 20.25.0305.1215 | 2025-03-05 | No | Yes | No | Yes | No |
| C | 20.25.0809.1142 | 2025-08-09 | No | No | Yes | No | No |
| D | 20.25.1201.0830 | 2025-12-01 | Yes | No | No | No | Yes |
| E | 20.26.0410.1010 | 2026-04-10 | No | Yes | Yes | No | No |
| F | 20.26.0901.1500 | 2026-09-01 | Yes | No | No | Yes | No |
| G | 20.27.0105.0930 | 2027-01-05 | No | No | Yes | No | No |
Resulting Applied Branding (Out of the box):
| Personalization Type | Selected Package | Version | Creation Date |
|---|---|---|---|
| Desktop Background | F | 20.26.0901.1500 | 2026-09-01 |
| Lock Screen | E | 20.26.0410.1010 | 2026-04-10 |
| Outlook Signatures | G | 20.27.0105.0930 | 2027-01-05 |
| Teams Background | F | 20.26.0901.1500 | 2026-09-01 |
| Screensaver | D | 20.25.1201.0830 | 2025-12-01 |
This approach allows mixing and matching the latest available elements across packages, ensuring devices always use the most recent version of each specific branding type—without requiring every package to include everything.
While the WPSecure engine prioritizes branding elements from the package with the highest version number by default, administrators can override this behavior by designating a specific package version as the default for one, several, or all branding element types.
This allows you to “pin” an older package (e.g., for a stable corporate standard or seasonal campaign) and ensure its elements are applied, regardless of newer packages being installed later.
Using the WPSecure Set utility to set default package versions
The command-line tool wpsecure-set.exe provides direct control over default selections. Run the executable with the appropriate flags and a target package version (**.**.****.****).
Examples:
Set a default package version for all branding types (makes this package the default for all types):
"C:\Program Files (x86)\wpsecure\wpsecure-set.exe" -dpv 20.24.2244.2135
Set default only for desktop backgrounds:
"C:\Program Files (x86)\wpsecure\wpsecure-set.exe" -dpvbg 20.25.1230.2135
Set default only for lock screen images:
"C:\Program Files (x86)\wpsecure\wpsecure-set.exe" -dpvls 20.25.1230.2202
Set default only for Outlook email signatures:
"C:\Program Files (x86)\wpsecure\wpsecure-set.exe" -dpvsigall 20.25.1230.2143
Set default only for video screensavers:
"C:\Program Files (x86)\wpsecure\wpsecure-set.exe" -dpvss 20.25.1230.2147
Set default only for Microsoft Teams backgrounds:
"C:\Program Files (x86)\wpsecure\wpsecure-set.exe" -dpvtbg 20.25.1230.2157
These wpsecure-set.exe commands can be deployed via Microsoft Intune, Group Policy startup scripts, or any other endpoint management solution.
Once a default package version is configured, the specified package’s branding elements will take precedence for the designated type(s)—provided the corresponding package is installed locally on the device. This override effectively breaks the automatic “highest version wins” hierarchy for those elements.
Precedence Order (When Defaults Are Set):
- Explicit default package version (per type or all types) – highest priority, if the package is installed.
- Highest version number among installed packages containing the element – fallback if no default is set or the default package is not installed.
- No branding element applied if none of the installed packages contain it.
The default settings remain in effect until they are explicitly cleared, changed, or the designated package is uninstalled (at which point the system reverts to the standard version-based selection).
Campaign Manager: Layered on Top for Ultimate Flexibility
The WPSecure Campaign Manager builds directly on top of both the highest version-based selection and any configured defaults, adding a powerful layer of scheduled, targeted, and prioritized control.
A single encrypted campaign file (deployed to devices via Intune or other MDM tools) defines one or more campaigns. Each campaign links a specific package version to:
- Start and end dates (for seasonal, event-based, or time-limited branding)
- User group ids (via a registry group ID, enabling segmented rollouts such as department-specific or pilot-group branding)
- Priority value (higher numbers win when multiple campaigns qualify)
Final Precedence Order (How Everything Stacks)
When determining which package provides a given branding element, the WPSecure engine evaluates in this strict order:
- Pending Reboot Messaging Package : When configured and a reboot is required, this package temporarily replaces desktop backgrounds, lock screen images, and video screensavers with the available personalization assets from the designated package.If only a subset of personalization types is available (for example, only a desktop background), only those available assets are applied.Please refer to the Pending Reboot documentation page.
These messages are enforced at the highest display priority to communicate urgent reboot notifications. - Active Campaigns from the Campaign File (highest priority): Only campaigns that meet all criteria are considered:
- The referenced package is installed locally and contains the element.
- Today’s date falls within the campaign’s active window.
- The user matches the assigned group.
- Among qualifying campaigns, the one(s) with the highest priority win.
- The selected campaign package(s) are placed at the top of the evaluation list (one or more).
- Configured Default Package Version (if set and installed): Acts as the next fallback after campaigns.
- Standard Version-Based Selection: After campaign-based exclusions are applied, all remaining locally installed packages are evaluated, and the package with the highest version number is selected. Packages excluded by the campaign file due to scheduling scope or user group assignments are omitted from the final list.
Conclusion
Every organization operates differently, with unique needs for branding consistency, rollout schedules, security requirements, and management complexity. There is no single “right” way to deploy and manage personalization packages—that’s why WPSecure is designed with ultimate flexibility and privacy in mind.
Whether you rely on simple version-based selection for effortless updates, pin a default package for an unbreakable corporate standard, or use the powerful Campaign Manager for scheduled, targeted, and prioritized campaigns, all decision-making and enforcement happens entirely locally on the device.
No external services, no third-party hosting, no cloud dependencies, and no telemetry are required. Packages are deployed once (via Intune, SCCM, or any MDM), and from that point forward, the WPSecure engine running on each endpoint independently evaluates and applies the correct branding elements—securely, offline, and without ever phoning home.
This fully local architecture gives you complete control, eliminates external points of failure or compromise, and ensures compliance in even the most stringent environments.
WPSecure Personalization Package is the most capable, adaptable, and privacy-focused Windows branding solution available—empowering you to deliver professional, consistent personalization across your entire fleet with total confidence.
