Grant/Revoke permissions to Windows local certificates (certlm) in non-admin mode

Hi,

No, it is not possible to change local machine certificate permissions without admin rights.

Windows stores the private keys for Local Machine (`certlm`) certificates in secure system folders, such as `%ALLUSERSPROFILE%\Microsoft\Crypto\Keys`. These files are owned by `SYSTEM` and `Administrators`. Because a non-admin account lacks `WRITE_DAC` permissions, calling CryptoAPI or CNG functions to modify the security descriptor will always fail with Access Denied (Error 5).

Since you are running as non-admin, you have to change when or where the change happens:

First, the standard Microsoft way is to handle this during installation. Your installer already runs with elevated privileges, so you can set the permissions once during deployment using `NCryptSetProperty` with `NCRYPT_SECURITY_DESCR_PROPERTY`. The runtime C++ application then just reads the key without needing to change any ACLs.

Second, if you cannot use an elevated installer, you must avoid the Local Machine store. Instead, import the certificate to the Current User store (`certmgr`) of the account running your application. Since that specific user owns the keys, your non-admin C++ app can modify the private key permissions freely without elevation.

references:

https://learn.microsoft.com/en-us/windows/win32/api/ncrypt/nf-ncrypt-ncryptsetproperty

https://learn.microsoft.com/en-us/windows/win32/seccng/cng-property-identifiers

https://learn.microsoft.com/en-us/windows/win32/seccng/key-storage-and-retrieval