The default image you found in C:\ProgramData\Microsoft\User Account Pictures\user.bmp is indeed the system-wide fallback. But when a user sets their own picture, Windows doesn’t just drop it in %appdata%\Microsoft\Windows\AccountPictures that path is often mentioned, but it’s misleading because it’s not where the OS actually pulls from during logon.
For local accounts, the custom images are stored under the user profile in: %ProgramData%\Microsoft\User Account Pictures (for defaults) and %SystemDrive%\Users\<username>\AppData\Roaming\Microsoft\Windows\AccountPictures (for per-user images).
The catch is that the per-user folder doesn’t always exist until the user explicitly sets a picture. Also, the files inside are GUID-named .accountpicture-ms packages, not plain .bmp or .jpg. These are essentially containers that hold multiple resolutions of the same image. If you want to consume them, you’ll need to parse the .accountpicture-ms format or use Windows APIs like IUserAccountPicture to retrieve the image in a usable form.
So, %appdata%\Microsoft\Windows\AccountPictures is the right place, but don’t expect a simple bitmap you’ll need to handle the .accountpicture-ms format. If you’re building a credential provider, the cleaner way is to call the Windows API rather than hardcoding paths, since that ensures you get the right image regardless of how the user set it.
Don't forget to share your experience with "Accept the answer" . That others in community with similar issues can benefit from the guidance and feel free to leave a message. We are happy to help!