Can anyone help me with the following JScript?

In Vista, I am trying to get "Local AppData" path for an user account (other than current user) on a local machine but facing some issue. can anyone pls help me what is wrong with the below code.

var HKU = 0x80000003; 
var username = "xyz";

//Loading registry hive of user xyz
var WshShell = new ActiveXObject("WScript.Shell");
var LoadHiveCmd = "REG LOAD " + "HKU" + "\\" + username + " \"" + "c:\\users\\xyz\\NTUSER.DAT" + "\"";
var oExec = WshShell.Exec(strLoadHiveCmd); 

var oReg = GetObject("WinMgmts:/root/default:StdRegProv"); 

var profileRegPath = username  + "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders";

var method, inparams, outpara开发者_如何学Pythonms;  

method = oReg.Methods_.Item("GetExpandedStringValue");
inparams = method.InParameters.SpawnInstance_();
inparams.hDefKey = HKU;
inparams.sSubKeyName = profileRegPath ;
inparams.sValueName =  "Local AppData";

outparams = oReg.ExecMethod_(method.Name, inparams);
var appDataPath= outparams.sValue;   

Here the appDataPath value in the registry is %USERPROFILE%\AppData\Local

But I am getting a value C:\Windows\system32\config\systemprofile\AppData\Local

I dont understand from where the value c:\windows\system32\config\systemprofile is coming and how it replaced %USERPROFILE% value.

USERPROFILE is a environment variable and will replace %USERPROFILE% to get it's correct location on this computer. it changes from computer to computer.

To see all environment variables type "set" on a command shell, or go to "Control Panel" > "System settings" > "Advanced" > Environment variables

GetExpandedStringValue automatically replaces any environment variables included in the registry value data with actual values of these variables. Most likely, %USERPROFILE% expands to C:\Windows\system32\config\systemprofile instead of C:\users\admin because the WMI service itself runs under Local System account.

What you need to get your script working is to:

• use GetStringValue instead of GetExpandedStringValue to read the unexpanded Local AppData value,

• get the profile path of the needed user by reading the ProfileImagePath value from the HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\<user_SID> key,

• do a string replace to substitute %USERPROFILE% with the profile path.

You can find an example of how to do this in this my answer:
Getting special Folder path for a given user in Jscript

You may also want to use WshShell.RegRead instead of WMI, because it's more JScript-friendly.