When the shell is assigned to cmd.exe, open to the logged in user's profile path. This appears to match the behavior of Windows Server 2003 userinit. It is also a prerequisite for ReactOS Server Core.