Understanding and Working in Protected Mode Internet Explorer
http://msdn2.microsoft.com/en-us/library/bb250462.aspx

Excerpt:
Low integrity processes can only write to folders, files, and registry keys
that have been assigned a low integrity mandatory label. As a result,
Internet Explorer and extensions run in Protected Mode can only write to low
integrity locations, such as the new low integrity temporary Internet files
folder, the History folder, the Cookies folder, the Favorites folder and the
Windows temporary file folders.

Q: Are there specific locations in the USER PROFILE or HKEY_CURRENT_USER
registry location that an extension in Protected Mode Internet Explorer can
not write to?

A: Yes, Internet Explorer-specific locations in the following USER PROFILE
folders.

Documents and Settings\%USER PROFILE%...
...\Local Settings\Temporary Internet Files
...\Local Settings\Temp
...\Local Settings\History ...\%USER PROFILE%\Favorites ...\%USER
PROFILE%\Cookies
Extensions can write to the following locations.

Documents and Settings\%USER PROFILE%...
...\Local Settings\Temporary Internet Files\Low
...\Local Settings\Temp\Low
...\Local Settings\History\Low ...\%USER PROFILE%\Favorites\Low ...\%USER
PROFILE%\Cookies\Low %USER PROFILE%\AppData\LocalLow

Every securable object has an IL that’s either explicit or implicit - See
figure 1
http://www.microsoft.com/technet/technetmag/issues/2007/06/UAC/default.aspx?pf=t
rue&fig=true#fig15

Inside Windows Vista User Account Control
http://www.microsoft.com/technet/technetmag/issues/2007/06/UAC/default.aspx

Excerpt:
You can use the built-in iCacls tool (%SystemRoot%\System32\iCacls.exe) to
view the ILs of files and the Sysinternals AccessChk utility to view the ILs
of files, registry keys, services and processes. Figure 17 reveals that the
IL of a directory that needs to be accessible by Protected Mode Internet
Explorer is Low.

Figure 17 AccessChk showing the IL of a user’s favorites directory (Click
the image for a smaller view)