I will answer the question in the title, as I just accidentally disabled Enhanced Protected Mode on a site, and wanted to return to the more locked-down configuration.
The list of sites for which Enhanced Protected Mode has been disabled is stored in HKCU\Software\Microsoft\Internet Explorer\TabProcConfig. The domain is the name, and the value is some kind of DWORD value (in my case, 0x147b). Removing the value re-enabled EPM on the site.
I found only two references to this registry key on the entire Internet. One was Eric Lawrence, the author of Fiddler and a former IE Program Manager (2004-2012), states:
The exception list is not exposed in the UI anywhere, and you can only clear the entire list by using Delete Browser History. How it works under the covers is undocumented, but if you use Process Monitor, you can see how the EPM list is written in the registry. When you exempt a site using the Notification bar, you'll see a write of the domain to a key under HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabProcConfig. The value is a DWORD which has various (undocumented) flags about what type of process should be used when loading a site (e.g. its integrity level, and the strictness of its AppContainer).