How can I extract the current user's account picture?

Question

I am trying to extract the current user's account picture in Windows 7, but I can't seem to figure out where it is located. I have found that the picture is sometimes written to the User's temp folder, but only after performing certain actions. It isn't always guaranteed to be there. Has anyone had any luck extracting this image? Thanks!

Update: I am trying to extract the image using C++, but help in any language would be a big step. :)

Answer 1

Whenever an API call needs the UserTile, it is copied to %TEMP%\%USERNAME%.bmp, which is usually C:\Users\username\AppData\Local\Temp\username.bmp.

But if you need to extract it directly from SAM, you can adapt the details from http://deployment.xtremeconsulting.com/2010/06/23/usertile-automation-part-1/, to make a program to read HKLM\SAM\SAM\Domains\Account\Users\????????\UserTile (in system context!), skip 12 bytes, read 4 bytes to uint, and read that uint number of bytes into a file.

Edit: I feel I should add that the API call that Explorer in Windows XP uses to get the icon, is an unnamed address in one of the logon DLL's (hence you can not call it yourself, since that address should change between versions), I can not remember which exact DLL at the moment.

Answer 2

It's described here under User Profile Tiles in Windows 7. It doesn't seem very encouraging.