%SystemRoot%\ServiceProfiles seems to store the following two subdirectories: S-1-5-18 seems to be stored under %SYSTEMROOT%\system32\config\systemprofile. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList with a subkey that starts with S-1-5-80) also have a sub directory below %SystemRoot%\ServiceProfiles. The name of the subdirectory is listed in the regestry in the respective value ProfileImagePath in the subkey below …\ProfileList\S-1-5-80-….