This doesn't say in what context to call IERefreshElevationPolicy. The blog post announcing this API suggests calling it in your extension installer after adding the new elevation policy. But the installer is typically running as the Administrator (often a different user) or as a service (automatic updates). Unfortunately, IERefreshElevationPolicy doesn't seem to signal all instances of IEUSER to reload the elevation policies, just the one for the current user. So this is still a Catch-22. How can the installer trigger other a policy cache refresh for other users?