According to the blog post, when a new user account was created in Windows XP the system chose an initial picture at random from the images stored in the %ALLUSERSPROFILE% folder that held the default pictures. The selection was performed using the RtlRandomEx pseudo‑random number generator, which was seeded with the value returned by GetTickCount() at the moment the account was being set up. The algorithm used for picking the picture is described as a one‑pass random selection method, which the author notes is a specific case of reservoir sampling where the sample size k equals one. The provided pseudocode shows a simple loop that increments a counter for each item seen, and with probability 1/counter replaces the current winner with the new item. This approach ensures that after scanning the entire list each item has an equal chance of being the final winner. The post explains two practical advantages of this method over a naïve two‑pass technique: first, it reduces the number of file‑system calls because the directory is traversed only once, which helps avoid the performance bottleneck associated with disk I/O; second, it remains correct even if the number of files in the directory changes while the algorithm is running, since the decision for each item is made immediately upon seeing it. As a safety measure, the code stops after examining the first 100 pictures. This prevents pathological slowdowns if a user or administrator places a very large number of files—such as a million—into the default pictures directory. By limiting the scan to 100 entries, the algorithm guarantees a bounded execution time while still providing a random selection from the subset that is actually examined. The author further illustrates the correctness of the one‑pass method by describing its recursive interpretation: the last item in a list of n items has a 1/n chance of being chosen; if it is not selected, the problem reduces to picking randomly from the first n−1 items, which can be solved by the same process applied repeatedly. Overall, the explanation shows how Windows XP combined a simple random number generator with an efficient sampling technique to assign a default user picture during account creation.
Key facts
- Windows XP used RtlRandomEx seeded with GetTickCount() for randomness
- The selection algorithm is a one‑pass reservoir sampling (k=1) method
- The algorithm scans the default pictures directory once, reducing file‑system calls
- It stops after 100 pictures to avoid slowdowns with large directories
- The method remains valid even if the directory contents change during the scan