Microsoft engineer Raymond Chen has documented how Windows XP selected the small picture assigned to a newly created user account, resolving a narrow but persistent question about the operating system’s behavior. The choice was random, but the implementation used a deliberate one-pass method suited to reading files from a directory.
According to Chen’s account on Microsoft’s The Old New Thing blog, Windows XP looked for candidate images in the shared Default Pictures directory under the system’s application-data location. It used the Windows RtlRandomEx function, initialized with the current value returned by GetTickCount, to make the selection. That approach was intended to vary the result rather than associate particular pictures with specific user names or account characteristics.
The more interesting detail is how the program selected from the available files. A straightforward implementation could first count every image, generate a random position and then scan the directory again to retrieve the file at that position. Windows XP instead used a single-pass algorithm: as each candidate appeared, it had a decreasing probability of replacing the current selection.
For the first file, the chance of selection is certain. The second then has a one-in-two chance of replacing it, the third a one-in-three chance, and the pattern continues. After all files have been considered, every candidate has the same probability of remaining selected. This is the one-item case of reservoir sampling, a technique for choosing randomly from a stream when its final size is not known in advance.
The implementation had practical advantages for a desktop operating system. It reduced filesystem work by avoiding a preliminary counting pass, and it did not depend on the directory remaining unchanged between two separate scans. Either issue could matter when storage access was comparatively slow or when software added or removed pictures while account creation was underway.
Microsoft also placed a limit on the process: the code stopped sampling after 100 pictures. Chen described that as a defensive measure against pathological cases, such as a directory containing an extremely large number of files. The cap meant the routine could complete predictably even if the folder’s contents no longer resembled the small default set shipped with Windows XP.
The explanation is not a new Windows feature or security change. It is a current technical disclosure about an implementation detail in an older operating system. Still, it illustrates how a familiar visual flourish rested on a standard computer-science method chosen for efficiency, tolerance of changing input and simple operation over a stream of directory entries.
