Access User registry from lsa logon process

I want to access data stored in c:\users\foo\appdata\roaming

I know that SHGetKnownFolderPath do the trick for the current user.
And it can for another user with logon or impersonation token.

I can find this path using RegOpenUserClassesRoot with logon or
impersonation token too.

But how access impersonation token from lsaApLogonUser ?
Since this function build data which is used from Lsa to build a
token, this token is not available.

Are the only way is to do an LsaLogonUser inside my LsaApLogonUser ?

(and then write a way to logon without a password ?)

Vincent Le Toux