Although Display Photo was set as PhotosFromADOnly in Lync management Shell,if you have Exchange Server 2013, the users can replace the picture in OWA.
Within Exchange 2013 Management Shell, run:
Get-OwaVirtualDirectory | fl *Photo*
You’ll see some like this:
Also, in OWA page, you can see the browse button to change the picture.
To avoid it, you can change the value of OWA Virtual Directory;
Set-OwaVirtualDirectory -Identity “Server\owa (Default Web Site)” -SetPhotoEnabled $False
And then check again Get-OwaVirtualDirectory | fl *Photo*
After it, recycle the owa pool or wait for it.
Finally, check if you have the button browse in OWA to change the picture.
Reference:
https://technet.microsoft.com/en-us/library/aa998588(v=exchg.160).aspx
https://technet.microsoft.com/en-us/library/dd298140(v=exchg.150).aspx
