Forum Discussion

siva72's avatar
siva72
Copper Contributor
Feb 04, 2026

Grant/Revoke permissions to Windows local certificates (certlm) in non-admin mode

I am working on granting/revoking permissions to windows local certificates (certlm) using Visual C++ 2022. The challenge is that this needs to be performed in non-admin privileges. We would need to remove "Everyone" permissions and grant read permissions for our NT Service account to windows local certificates (certlm). Is it possible to perform under non-admin privilege? It would be great help if can get solution for this.

Csharp

1 Reply

  • Harold-Picado's avatar
    Harold-Picado
    Brass Contributor
    Jul 17, 2026

    Hi,

    No, it is not possible to change local machine certificate permissions without admin rights.

    Windows stores the private keys for Local Machine (`certlm`) certificates in secure system folders, such as `%ALLUSERSPROFILE%\Microsoft\Crypto\Keys`. These files are owned by `SYSTEM` and `Administrators`. Because a non-admin account lacks `WRITE_DAC` permissions, calling CryptoAPI or CNG functions to modify the security descriptor will always fail with Access Denied (Error 5).

    Since you are running as non-admin, you have to change when or where the change happens:

    First, the standard Microsoft way is to handle this during installation. Your installer already runs with elevated privileges, so you can set the permissions once during deployment using `NCryptSetProperty` with `NCRYPT_SECURITY_DESCR_PROPERTY`. The runtime C++ application then just reads the key without needing to change any ACLs.

    Second, if you cannot use an elevated installer, you must avoid the Local Machine store. Instead, import the certificate to the Current User store (`certmgr`) of the account running your application. Since that specific user owns the keys, your non-admin C++ app can modify the private key permissions freely without elevation.

    references:

    https://learn.microsoft.com/en-us/windows/win32/api/ncrypt/nf-ncrypt-ncryptsetproperty

    https://learn.microsoft.com/en-us/windows/win32/seccng/cng-property-identifiers

    https://learn.microsoft.com/en-us/windows/win32/seccng/key-storage-and-retrieval