Although Display Photo was set as PhotosFromADOnly in Lync management Shell,if you have Exchange Server 2013, the users can replace the picture in OWA.
Within Exchange 2013 Management Shell, run:
Get-OwaVirtualDirectory | fl *Photo*
You’ll see some like this:
Also, in OWA page, you can see the browse button to change the picture.
To avoid it, you can change the value of OWA Virtual Directory;
Set-OwaVirtualDirectory -Identity “Server\owa (Default Web Site)” -SetPhotoEnabled $False
And then check again Get-OwaVirtualDirectory | fl *Photo*
After it, recycle the owa pool or wait for it.
Finally, check if you have the button browse in OWA to change the picture.