Authorization Controls for Offline Windows C# Application

Question

I've been looking into trying to see if there are any authorization controls that can be implemented for a local, and offline, .NET application that are tied to the Windows local authentication. The Windows AuthZ API (C++) for example provides a means to request for a user to authenticate and ultimately spin off a process within the context of that user but are there any authorization controls that might be implemented such that an offline C# program could leverage Windows authentication and then restrict access to specific function calls based on a SID?

I'm aware of the fact that in this scenario that bypassing those controls might be relatively easy as an authenticated user might just be able to patch the application but additional security controls could be placed on the system itself to increase the level of effort necessary for such actions to take place - kiosk mode for example.

To expand on that point, I do realize the DPAPI/NG can be leveraged to protect secrets based on the user authenticated to the machine but are there any inherent controls that could be used such that authorization restrictions could be placed within the program itself that are verified through a Windows API call in a C# application?

Answer 1

You cannot lock down any user from anything on its own device.

User can patch the application to sidestep the checks, can patch Windows APIs to return whatever he wants, can create an user with all privileges he wanted.

The game industry is trying really hard to implement client-side protection, some use kernel drivers, even employ rootkits, but cheaters still are able to bypass protections and misuse the game client.

So it's useless to try? No, it's not.

You can raise the bar, so the effort to bypass the protections are higher than the payout from doing so. If the user have low incentive to break your program, they won't bother. On the other hand, if the payout is larger than the effort, they will find a way to break it.