Great that you got it all working! Maybe you can post your final code for future reference?
Just adding some notes, also future reference:
Vista SP1 and Server 2008 share the same kernel and terminal server.
I don't see why WTSQueryUserTokenEx should fail on vista (it uses undocumented
api from JwaWinsta but actually it does exactly the same as WTSQueryUserToken internally).
Don't forget this note about WTSGetActiveConsoleSession:
Return Value
The session identifier of the session that is attached to the physical console. If there is no session attached to the physical console, (for example, if the physical console session is in the process of being attached or detached), this function returns 0xFFFFFFFF.
On Windows 2000 with Terminal Server it's safe to assume session 0 is the console session.
If you launch a process as user system you always get the environment of Default User because system doesn't have one, same goes for CURRENT_USER in the registry.