Hi there,
I think this may be due to the UAC that enables protected mode, rather than Protected mode itself. As outlined here, low integrity processes do not have the same access to other windows and internals that they used to have in earlier versions of Windows. You may wish to consider creating a broker that runs at a higher integrity level and handles the system try notifications.
Hope this helps...
-- Lance
I ended up getting my extension to run outside protected mode. In this case, it is unnecessarily complicated to create a separate broker.