If you can log on as a user, you can run
to get the correct profile path. But if you are logged on as another user, or even across the network, here is the down-and-dirty way to get the same info.
1. List domain users and their SIDS, from an administrative command prompt:
wmic useraccount get domain,name,sid
2. Open this registry key to see the list of profiles on the machine:
3. Look for the key under ProfileList that matches the SID. Then in that key, look for the ProfileImagePath value. This gives the path to the local profile.