When installing software on a standard user account, is it safer to use the UAC pop up to type the admin password into, or switch user to admin then do the install in that user?
They are both essentially the same, let's think of the possible scenarios.
- an attacker takes over a single user
- an attacker has admin or more permissions on the machine
Since Uac runs in a restricted desktop the standard user has no access to that desktop object, meaning that any keylogging, injection or screen logging activity done in this permission set should be blocked, the same as running in a different login session. Assuming the second scenario the attacker has full access, meaning that it doesn't matter.
If we are talking about exploiting the mechanisms both have a pretty big attack surface(assuming an exploit or bypass);
uac has anything from registry or path based side loading, the desktop object not being secure and the entire consent mechanism being broken.
Logins have the registry profile, files on disk, lsass rpc calls, gpo and many other attack vectors for exploitation.
I would go with what is easier for you, just keep your admin password cycling and the account usage to a minimum and you should be safe in that regard.