Note: It may be easier to carry out these test steps using two different browsers (or similar) so that you can keep one logged in as 'admin' and use the other to log into user accounts. Go to site administration and search 'forcelogin'. There should be 3 results. Change the settings if necessary to match the defaults - forceloginforprofiles should be turned on, the other two should be off. If anything changed, press Save changes . You will need two test accounts that you can log into, so create two new accounts via Site administration / Users / Accounts / Add a new user : Set the username to pictest1 (the first user) or pictest2 . Set the password to anything suitable so you can log in later. Set the first name to Pic test and the last name to either 1 or 2 . Set the email address to something suitable, e.g. pictest1@email.invalid . Drag and drop an image (different for each user) to the New picture file area underneath the User picture heading. Press Create user . Create a new role using Site administration / Users / Permissions / Define roles screen: Click Add a new role button. Leave archetype at No role and click Continue . In the form, set short name and full name to dangerous . In the Context types where this role may be assigned setting, tick the box for System context type. Press Show advanced if necessary to see the 'Prohibit' options. Find the moodle/user:viewprofilepictures capability and set this to Prohibit . Press Create this role button. Assign the role to pictest2 using Site administration / Users / Permissions / Assign system roles screen: Choose the dangerous role. Type pictest2 in the right-hand search box, select the user when they appear in the right-hand box, and click Add . Go to a test course and enrol both users as students. Create a forum on the test course. Log in as pictest1 and post a discussion in the forum. Log in as pictest2 and post a discussion in the forum. EXPECTED: User pictest2 can see the two different user pictures against their own discussion and against user pictest1's discussion. By right-clicking and choosing Copy image link or similar (name varies slightly depending on browser), copy the URL of pictest1's user picture. Open a new browser tab, paste in the URL and check it loads correctly. Keep the tab open for later. Back as admin , go into Site administration and search forcelogin again. This time, enable the forceloginforprofileimage setting and press Save changes . Back as pictest2 , reload the forum page. EXPECTED: You should see pictest2's profile image next to their discussion, but pictest1's profile image should now display as the default picture. Still as pictest2, go to the tab with pictest1's user image. Copy the URL and paste it into a new tab (this is so you still have the original URL in the other tab). Hit return to load the picture. If it still shows the user image, hold down Shift (to skip browser cache) and press Reload. EXPECTED: The image now redirects to the default picture. Back as admin , turn off forceloginforprofileimage setting and turn on forcelogin , then press Save changes . Repeat the above tests 12 and 13. Results should be the same (except that it won't have the image in cache so you won't need to reload on step 13). Now log in as pictest1 (who doesn't have the 'dangerous' role) and therefore gets default behaviour. Go to the forum page. EXPECTED: Both profile pictures display.