--- a/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
+++ b/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
@@ -92,17 +92,17 @@ SandboxBroker::SetSecurityLevelForConten
 
     result = mPolicy->SetAlternateDesktop(true);
     ret = ret && (sandbox::SBOX_ALL_OK == result);
   } else {
     result = mPolicy->SetJobLevel(sandbox::JOB_NONE, 0);
     bool ret = (sandbox::SBOX_ALL_OK == result);
 
     result = mPolicy->SetTokenLevel(sandbox::USER_RESTRICTED_SAME_ACCESS,
-                                    sandbox::USER_RESTRICTED_SAME_ACCESS);
+                                    sandbox::USER_NON_ADMIN);
     ret = ret && (sandbox::SBOX_ALL_OK == result);
 
     result = mPolicy->SetDelayedIntegrityLevel(sandbox::INTEGRITY_LEVEL_MEDIUM);
     ret = ret && (sandbox::SBOX_ALL_OK == result);
   }
 
   // Add the policy for the client side of a pipe. It is just a file
   // in the \pipe\ namespace. We restrict it to pipes that start with