At least it looks like it is hardcoded to always write ProjectState.xml to the program files directory.
----------
System.UnauthorizedAccessException: Access to the path 'C:\Program Files (x86)\CruiseControl.NET\server\ProjectsState.xml' is denied.
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy)
at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
at ThoughtWorks.CruiseControl.Core.Util.SystemIoFileSystem.OpenOutputStream(String fileName)
at ThoughtWorks.CruiseControl.Core.State.XmlProjectStateManager.SaveProjectStates()
at ThoughtWorks.CruiseControl.Core.IntegrationQueueManager.Stop(String project)
at ThoughtWorks.CruiseControl.Core.CruiseServer.<Stop>b__1(ProjectRequest arg, Response resp)
at ThoughtWorks.CruiseControl.Core.CruiseServer.RunProjectRequest(ProjectRequest request, Nullable`1 permission, Nullable`1 eventType, ProjectRequestAction action)
----------```