Try the SANDOX_INERT flag in CreateRestrictedToken...

sandbox/src/restricted_token.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/src/restricted_token.h"
 
 #include <vector>
 
 #include "base/logging.h"
 #include "sandbox/src/acl.h"
@@ skipping 69 matching lines @@
     privileges_to_disable_array = new LUID_AND_ATTRIBUTES[privileges_size];
 
     for (unsigned int i = 0; i < privileges_size; ++i) {
       privileges_to_disable_array[i].Attributes = 0;
       privileges_to_disable_array[i].Luid = privileges_to_disable_[i];
     }
   }
 
   BOOL result = TRUE;
   HANDLE new_token = NULL;
+  // The SANDBOX_INERT flag did nothing in XP and it was just a way to tell
+  // if a token has ben restricted given the limiations of IsTokenRestricted()
+  // but it appears that in Windows 7 it hints the AppLocker subsystem to
+  // leave us alone.
   if (deny_size || restrict_size || privileges_size) {
     result = ::CreateRestrictedToken(effective_token_,
-                                     0,  // No flags.
+                                     SANDBOX_INERT,
                                      static_cast<DWORD>(deny_size),
                                      deny_only_array,
                                      static_cast<DWORD>(privileges_size),
                                      privileges_to_disable_array,
                                      static_cast<DWORD>(restrict_size),
                                      sids_to_restrict_array,
                                      &new_token);
   } else {
     // Duplicate the token even if it's not modified at this point
     // because any subsequent changes to this token would also affect the
@@ skipping 350 matching lines @@
 
   return ERROR_SUCCESS;
 }
 
 unsigned RestrictedToken::SetIntegrityLevel(IntegrityLevel integrity_level) {
   integrity_level_ = integrity_level;
   return ERROR_SUCCESS;
 }
 
 }  // namespace sandbox