tl;dr: I would really like a way to "elevate" an app (an installer, for example) so it runs as my user but can modify my start menu, add auto-updaters to my startup folder, etc. It should not be able to change those settings for other users, or modify system-wide settings. The default UAC runs it as admin and lets it do anything it wants, as far as I can tell (though usually to the Admin account rather than mine).
I recently set up a Win7 64-bit laptop with normal and admin accounts to avoid the security holes that come with running as admin, but I'm pulling out my hair because everything wants the Admin password, especially unsigned open source software (which I run a lot of). That would be bearable on its own, but UAC then proceeds to run the app as Admin.
This seems like a Bad Thing from a security standpoint, if there's apparently nothing between "Can't do anything without triggering UAC" to "Holds the keys to the kingdom."
Security concerns aside, there's also a big usability problem with the arrangement because the app, running as Admin, tends to create files owned by admin (which I then can't access from my account), tends to suggest saving and loading files from Admin's Documents/Pictures/Music folders (which I can't access and which I don't want to access anyway). Installers even install apps to the Admin account instead of mine, meaning after the dust settles there isn't even a start menu entry to be able to trigger UAC with.
I've Googled all over, and have found advice ranging from disabling UAC entirely to hacking the registry (to either selectively disable UAC for certain apps or classes of apps), to creating application manifests specifying "runAsInvoker" (but which breaks the app's internal checksum and prevents it running at all), to running in XP mode to running the application compatibility toolkit and installing a custom database in %windows%\system32. None of these sounds like a very workable solution, either breaking UAC's safeguards entirely, or requiring significant per-app fiddling that may or may not actually work.
Note that none of the apps in question actually needs Admin privileges, and if one ever tried to modify system settings or mess with other users that would indicate a serious bug or that they've been compromised by malicious software. In other words, UAC would be really useful to have around at that point.
Is this just not possible in Windows and I should just give my user admin privileges and be done with it? Is it doable but requires one of those hackish techniques I found on Google? (if so, which)? Or is it straightforward---even easy---and my Google-foo is just really bad lately? (if so, what is the trick)?