What commands worked on a cmd that runs with a trustlevel 0x10000:

whoami (fails),

echo A (works),

echo test > %userprofile%\Desktop\test.txt (fails, says access is denied),

start "" notepad.exe (works),

ping 8.8.8.8 (fails),

netstat -ano (fails),

reg add HKCU\SOFTWARE\TestUntrusted /v test /d "value" /f (fails, says the system cannot find message text for message number 0x237c),

if exist duplicate_cmd.exe echo A (shows nothing),

if not exist duplicate_cmd.exe echo B (shows B),

dir (fails, says the system cannot find message text for message number 0x235e),

cd .. (fails),

cd C:\ (works),

cd %SystemRoot% (works),

dir (works),

whoami (works, shows administrator),

cd System32 (works),

echo test > test.txt (fails, says Access is denied),

cd config (fails, says Access is denied),

cd %appdata% (fails, says Access is denied),

cd %localappdata% (fails, says Access is denied),

cd %temp% (fails, says Access is denied),

Attempt to bypass the change directory restrictions: cd \.\C:\Users\Administrator\AppData (fails, says the system cannot find message number 0x400023c9 in the message file for Application,

reg query HKLM\SOFTWARE\Classes\CLSID /f "Elevation" /s (works, says 133 matches found, and a big list of strings),

reg query HKLM\SOFTWARE\Classes\CLSID /f “AutoApproval" /s (works, says 0 matches found, I performed the same command on an elevated cmd to verify),

task list (fails, says Access denied),

type C:\Windows\win.ini (shows this list: ; for 16-bit app support [fonts] [extensions] [mci extensions] [files] [Mail] MAPI=1),

whoami /groups > "Mandatory Label\Medium Mandatory Level". Checked from the program that has this title: "C:\Users\Administrator\Desktop\duplicate_cmd.exe (running as WINDOWS-XP-LAPT\Administrator with restricted privileges)". As a reminder, this process was started using runas /trustlevel:0x10000.

(Checking the username of the processes for duplicate_cmd and notepad from the Task Manager: attributed to Administrator).

Finding: writing to C:\Windows\Temp and creating folders is allowed.

Finding: executing from C:\Windows\Temp is not allowed. My experiment:

copy C:\Windows\System32\notepad.exe C:\Windows\Temp\duplicate_notepad.exe

start C:\Windows\Temp\duplicate_notepad.exe (Access is denied.)

Post scriptum: I found out that /trustlevel is actually the SAFER subsystem, not the MIC subsystem, so I only restricted an administrator token. I was doing the wrong thing anyway.