How to get location of %temp%\Low when running as a low intergrity process

Question

When a process is running at the low integrity level, you can't write to %temp% so I need a way to find the path to the %temp%\Low directory (Without hardcoding the word "Low")

Answer 1

According to MSDN

"Low-integrity processes can write and create subfolders under %USER PROFILE%\AppData\LocalLow"

I don't think there's any way to avoid hardcoding thost last two folders.

Answer 2

ShGetKnownFolderPath

Answer 3

According to MSDN

When in Protected Mode, extensions can write files to a folder below the user's UserProfile folder, typically %userprofile%\AppData\LocalLow. Use the SHGetKnownFolderPath function with the FOLDERID_LocalAppDataLow flag to obtain the expanded folder name.

SHGetKnownFolderPath(FOLDERID_LocalAppDataLow, 0, 
   NULL, szPath, ARRAYSIZE(szPath));