Can be used to write a files to user profile directories of various Windows system accounts - NetworkService, LocalService

New-ProfileFile.ps1

function New-ProfileFile([byte[]]$Contents, [string]$Name, [string]$SubDir = '')
{
  $profileRoot = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList'
  $sysProfile = Join-Path 'config' 'systemprofile'

  #system
  (Get-ItemProperty "$profileRoot\S-1-5-18").ProfileImagePath,
  #local service
  (Get-ItemProperty "$profileRoot\S-1-5-19").ProfileImagePath,
  #network service
  (Get-ItemProperty "$profileRoot\S-1-5-20").ProfileImagePath,
  #this will usually be the same as the first
  (Join-Path ([Environment]::GetFolderPath('System')) $sysProfile),
  #must handle SYSWOW64 on x64 (works inside both 32-bit and 64-bit host procs)
  (Join-Path ([Environment]::GetFolderPath('SystemX86')) $sysProfile) |
    Select -Unique |
    ? { Test-Path $_ } |
    % {
        $root = Join-Path $_ $SubDir
        if (!(Test-Path $root)) { New-Item $root -Type Directory }
        $path = Join-Path $root $Name
        Write-Log "Writing file to $path"
        $Contents | Set-Content $path -Encoding Byte
    }
}