You don't. A standard Windows user has access to tens (hundreds if self-installed apps are allowed) of automated protocol and file handlers, all of which can access hundreds of undocumented persistent registry keys, scheduled tasks, and other apps that persist and can be DLL hijacked.
Then there's the UAC layer which has dozens of bypasses, leading to privilege escalation -- in addition to hundreds if not thousands of SYSTEM-level privilege escalations through things like drivers and font-scalar engines (too-numerous to even list how many methods there are).
Once elevated, that sort of defeats the whole purpose of this conversation, but WMI subscription and many other precaution techniques become available. It's even worse when the computer is on a Windows Server Domain.
I might argue that you also can't reduce privileges on a Unix or Linux host in the same way, but you seem to be convinced that a single binary with restricted permissions is somehow in some sort of sandbox. It's not. Even in chroot, it is not. I did a Google search for chroot escapes and there's nearly 100k hits.