Find temp folder for user Network Service?

The temp folder for the Network Service account is located here:

%Windir%\ServiceProfiles\NetworkService\AppData\Local\Temp

On Windows XP/2003 the network service profile is located in the general user profile directory. On a German machine it is here:

C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Temp

On an English computer it would be here:

C:\Documents and Settings\NetworkService\Local Settings\Temp

You can find the path to the profile on all Windows versions by querying this registry value:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20\ProfileImagePath

That does not give you the localized name of "Local Settings" on XP/2003, though.

By default, Administrators can write to the network service profile. Using it's temp folder for your purpose should be perfectly OK.

On Windows Vista and above

1. System Account (NT AUTHORITY\SYSTEM)
   C:\Windows\TEMP

2. Network Service (NT AUTHORITY\NETWORK SERVICE) C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp

3. Local Service (NT AUTHORITY\LOCAL SERVICE)C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp

Why not just give NETWORK_SERVICE permission to a specific folder and tell the users to place the backup files there?

Or just run:

BACKUP DATABASE [master] TO DISK='master.bak'GO

from SSMS and see where the file gets written to.