In WSH you can retrieve the path of special folders via the WScript.Shell.SpecialFolders Property. Similar APIs exist for .NET based languages.
Unfortunately neither is the documentation of the existing special folders complete, nor is the list of special folders available via the SpecialFolders property complete.
Some of the special folders are available as environment variables. Unfortunately only few though.
And also, still unfortunately, the names for the special folders differ in WScript.Shell.SpecialFolders and the .NET API.
Also, unfortunately the Enumerator in WSH JScript does not offer a way to retrieve the name/key of the value. So while 16 names are documented, the enumerator/the SpecialFolders property gives access to 18 values at the moment. But you have to guess the names of the undocumented two names.
Is this Microsoft’s way to say “Gee, forget about these APIs, go use the native Windows API dude, this other stuff is nothing we care about much, isn’t it obvious?”. This would fit into the “keep pushing C++ for any solution that tries to do something creative” school of thought that Microsoft so happily sticks to (shell extensions in .NET? Definitely not a good idea nor supported…)
Sad that MS still expects us to write software which handles the difference between local and roaming application data while on the other hand being so lax about documentation and consistency and availability of required information.