How Windows XP Randomly Picked Your First Account Avatar

A reader question prompted Raymond Chen to explain the mechanism behind Windows XP’s assignment of a random profile picture when a new account was created. The system drew from the images in the Default Pictures directory using RtlRandomEx, seeded with the value of GetTickCount() at the time the account was made.

Rather than counting all the files and then indexing into them, XP used a single-pass selection — a k=1 case of reservoir sampling. As it walks the directory, each newly encountered file has a 1-in-N chance of replacing the current pick, which mathematically yields a uniform choice by the end of the walk. The design was deliberate: it cuts filesystem calls, the real bottleneck, roughly in half, and it stays correct even if files are added or removed while the enumeration is running, since it never depends on a fixed count.

The implementation also includes a defensive cap, halting after 100 files so that an absurdly overstuffed directory can’t turn account creation into a pathological loop. It’s a small detail, but a clean illustration of why one-pass algorithms are often preferable when I/O dominates cost and the underlying data can shift underneath you.