How Windows XP Picks a Default User Photo Using a One‑Pass RNG

Background and Community Interest

The default avatar shown when a new Windows XP account is created comes from the folder %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures.

Users have long wondered how the operating system selects one image from that collection at random.

A question posted on Hacker News on December 11 2025 asked whether anyone had uncovered the random‑number generator behind the choice.

Algorithm and Implementation

The answer identifies the RNG as the Windows kernel function RtlRandomEx, seeded with the current value returned by GetTickCount.

As the responder states, “The random number generator is our friend RtlRandomEx, using the current value of GetTickCount() as the initial seed.”

Instead of a two‑pass method that first counts files and then selects an index, Windows XP uses a single‑pass selection algorithm.

This design reduces the number of file‑system queries, which are the primary performance bottleneck when enumerating directory entries.

The one‑pass approach also avoids complications if files are added or removed while the enumeration is in progress.

The technique is a special case of reservoir sampling where the sample size k equals 1.

In this scenario the algorithm can be expressed as a loop that tracks a running count and replaces the current winner with the newly examined file with probability 1/count.

Specifically, for each file the code increments a counter and then draws a uniform random number between 1 and the counter; if the draw equals the counter, the current file becomes the new winner.

When the iterator reaches the end of the directory, the file stored as the winner is returned as the default picture.

Because the probability of any particular file being selected is 1/n, where n is the total number of files, the method guarantees a uniform distribution without needing to know n in advance.

A safety check caps the sampling loop after 100 files have been examined.

This limit prevents pathological behavior if a user populates the Default Pictures folder with an excessively large number of files, such as a million images.

Practical Implications

The use of RtlRandomEx and GetTickCount means the selection is deterministic for a given tick count but appears random to the user.

Because the algorithm requires only a single pass through the directory, the time to create a new user account remains short even on slower storage media.

The reservoir‑sampling logic ensures that the result is unbiased regardless of the order in which the file system returns entries.

By stopping after 100 files, the code protects the system from unnecessary work while still providing a representative random choice for typical default‑picture collections.

Overall, the design reflects a careful balance between efficiency, correctness, and robustness in a legacy operating system.

Why This Matters: Understanding the simple yet effective RNG technique reveals how Windows XP achieved fast, unbiased profile picture selection without costly file‑system operations.