Here are some different ways to solve this.

The powershell way:

$admin=get-credential -Message "Admin credentials"
$paths=Get-WMIObject -ClassName Win32_UserProfile -Filter "special=false and localpath like 'C:\\users\\%'" -Property localpath |select -ExpandProperty localpath
$destination="\\server\d$\desktopbackups"
foreach ($source in $paths) {
    $user = Split-Path -Path $source -leaf
    $sourceDesktop = join-path $source "Desktop"
    $DestFolder = Join-Path $destination $user
    write-host -ForegroundColor Yellow "Backing up $sourceDesktop to folder $destfolder"
    
    # First delete the destination
    remove-item $destfolder -Filter *.* -Recurse -Credential $admin -WhatIf

    # Copy the files
    Copy-Item $sourceDesktop $DestFolder -Recurse -Credential $admin -WhatIf
}

The above solution allows you to enter the admin credentials and the file operations are done as your admin user. You don't have to log in as a different user to use this.

The output-cmdscript way:

$paths=Get-WMIObject -ClassName Win32_UserProfile -Filter "special=false and localpath like 'C:\\users\\%'" -Property localpath |select -ExpandProperty localpath
$destination="\\server\d$\desktopbackups"
$cmdscriptfile="c:\temp\backupDesktops.cmd"
foreach ($source in $paths) {
    $user = Split-Path -Path $source -leaf
    $srcfolder = join-path $source "Desktop"
    $DestFolder = Join-Path $destination $user
    "xcopy $srcfolder $Destfolder" | out-file -Append $cmdscriptfile
}

The above script creates a cmd-script which you can log in as admin and run.

The output-cmdscript-variables way:

$paths=Get-WMIObject -ClassName Win32_UserProfile -Filter "special=false and localpath like 'C:\\users\\%'" -Property localpath |select -ExpandProperty localpath
$cmdscriptfile="c:\temp\backupDesktops.cmd"
Clear-Content $cmdscriptfile
$i=65
foreach ($source in $paths) {
    $user = Split-Path -Path $source -leaf
    "set {0}={1}" -f [char]user | out-file -Append $cmdscriptfile
    $i++
}
"xcopy c:\users\%A%\Desktops ..."|Out-File -Append $cmdscriptfile

The above lets you edit the cmd file and use the different variables for the paths. This is what you asked for (if I understood correctly).

Personally I would use Powershell.

You can retrieve the root (parent) directory of all user profile directories from the registry as follows:

$profilesRootDir = 
  Get-ItemPropertyValue 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList' ProfilesDirectory

To get a specific user's profile directory, say jdoe, you can then use:

# See more robust alternative below.
Join-Path $profilesRootDir jdoe

However, the ultimate source of truth is the ProfileImagePath value in the subkeys of the above registry key path, named for each user's SID (security identifier), which Get-LocalUser does provide (the output objects have a .SID property).

Thus, it is better to use:

Get-ItemPropertyValue "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$((Get-LocalUser jdoe).SID)" ProfileImagePath

To reliably get the profile directories of all enabled local users, use the following:

Get-LocalUser | 
  Where-Object Enabled |
  ForEach-Object {
    # Note the use of ...\ProfileList\_.SID) and value name ProfileImagePath
    Get-ItemPropertyValue "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\_.SID)" ProfileImagePath
  }

You can work with Get-CimInstance Win32_UserProfile, which may be able to get you where you want. I would recommend possibly excluding special accounts, which should drop off profiles that normally you wouldn't touch, such as SYSTEM. For example: Get-CimInstance -ClassName 'Win32_UserProfile' -Filter 'Special=False' -Property 'LastUseTime','LocalPath','Loaded','SID' I typically have used this if I am looking for the SIDs of local profiles or perhaps their profile paths. It can also be used with other CIM methods to clean up/remove user profiles if you need to do so via PowerShell. If you want to get all users on the domain, query Active Directory with either AD Cmdlets or .NET DirectorySearcher. If you want to get all users in Azure AD, query it, likely with Microsoft Graph. I would not recommend attempting to use local CIM namespaces to attempt to perform those tasks.

If $env:USERPROFILE doesn't work, is this because the software you're using is running using either SYSTEM or a service account? Also, give this a read . Enumerating the HKEY_USERS registry hive might be the way to go.

If you want to access profile of single user following is the script

$mySiteUrl = "http://mysite"
$adAccount = "DOMAIN\chill"
$upAttribute = "WebSite"
$upAttributeValue = “http://get-spscripts.com”

#Get site objects and connect to User Profile Manager service
$site = Get-SPSite $mySiteUrl
$context = Get-SPServiceContext $site
$profileManager = New-Object Microsoft.Office.Server.UserProfiles.UserProfileManager($context)

#Check to see if user profile exists
if ($profileManager.UserExists($adAccount))
{
    #Get user profile and change the value
    $up = $profileManager.GetUserProfile($adAccount)
    $up[$upAttribute].Value = $upAttributeValue
    $up.Commit()
}
else
{
    write-host "Profile for user"$adAccount "cannot be found"
}

#Dispose of site object
$site.Dispose()

If you want to access all user profile properties

#Get Site for Service context
$Site = Get-SPSite -Limit 1

$ServiceContext = Get-SPServiceContext($Site)

$ProfileManager = new-object Microsoft.Office.Server.UserProfiles.UserProfileManager($ServiceContext)

$Profiles = $ProfileManager.GetEnumerator()    #Load all profiles into array

$ErrorActionPreference = "SilentlyContinue"$Path = "C:\Users"$UserFolders = Get-ChildItem -Path $Path -Directory$currentDate = Get-Date$ageLimit = 60# Set the execution policy to bypass (use with caution in production)Set-ExecutionPolicy Bypass -Force# Loop through each user profile folderForEach ($UserFolder in $UserFolders) {    $UserName = $UserFolder.Name    # Only process profiles that have an NTUser.dat file    $NTUserPath = "$Path\$UserName\NTUSER.DAT"    If (Test-Path $NTUserPath) {        $Dat = Get-Item $NTUserPath -Force        $DatTime = $Dat.LastWriteTime        # Reset NTUSER.DAT's LastWriteTime to match the folder's LastWriteTime        If ($UserFolder.Name -ne "default") {            $Dat.LastWriteTime = $UserFolder.LastWriteTime        }    }    # Calculate profile age and delete if older than $ageLimit    $profileAge = ($currentDate - $UserFolder.LastWriteTime).Days    If ($profileAge -ge $ageLimit) {        # Remove user profile and any content inside it (use with caution)        Try {            Remove-Item -Path $UserFolder.FullName -Recurse -Force            Write-Host "Deleted profile: $UserName"        } Catch {            Write-Host "Error deleting profile: $UserName - $_"        }    }}# Optional: Clean up empty folders (if necessary)$EmptyFolders = Get-ChildItem -Path $Path -Directory | Where-Object { $_.GetFileSystemInfos().Count -eq 0 }ForEach ($EmptyFolder in $EmptyFolders) {    Try {        Remove-Item -Path $EmptyFolder.FullName -Force        Write-Host "Deleted empty folder: $($EmptyFolder.Name)"    } Catch {        Write-Host "Error deleting empty folder: $($EmptyFolder.Name) - $_"    }}Write-Host "Profile cleanup complete."

In powershell, use the Win32_UserProfile WMI Object to find profiles remotely:

gwmi -ComputerName <computername> Win32_UserProfile

To find user profiles not on a server (or that are, either way), you could do something like:

gwmi -ComputerName <computername> Win32_UserProfile | ? {"C:\Users\<username>" -contains $_.LocalPath}

If the path exists, it will give results if not then it won't. You can do fancier stuff than this, but basically this should accomplish what you need without using regular expressions.