windows service: get each users' %APPDATA% variable

Question

My application runs as service and at some point it needs to loop through all existing user accounts on the system(I figured this can be done with NetUserEnum()) and try accessing a certain file under each of found users' %APPDATA% path. Problem is I have no idea how to get that user-specific path (%APPDATA%).

Since application runs as service (SYSTEM), I cannot use environment or SHGetFolderPath(). Initially I thought I could make a use of LogonUser() but it always throws error 1326 at me, no matter if I run my application test code under user, admin or SYSTEM. (winxp as test platform). If there is a way to obtain user login handle, I can use that in SHGetFolderPath() or ExpandEnvironmentStringsForUser() APIs, is that correct?

So, the code I tried so far with LogonUser() is about the following(yes, username IS correct):

LogonUser(
    pw->usri1_name,
    L".",
    NULL,
    LOGON32_LOGON_BATCH,
    LOGON32_PROVIDER_DEFAULT,
    &authtoken
)

It probably wants my password but there is no way I know that on customer machine. All the APIs I found with quick search rely on HANDLE from LogonUser() which I apparently cannot have...

Any non-tricky and tricky ideas welcome!

Answer 1

Solution and conclusions so far.

You cannot use LogonUser() properly.

Instead, your options come to bruteforcing the path after user homedir(which you still obtain via any preferred method, my suggested is NetUserEnum()), based on one of the following:

• SHGetFolderPath(CSIDL_APPDATA)
• reg key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

If you know of any other method please comment.