On desktop apps I've been using a Clarion Template (3rdParty, http://www.capesoft.com/accessories/secwinsp.htm).
With web apps, pretty much just been using the simple fact that the User has to log in, and tracking the activity. If they have an account, it means they've paid.
Desktop is a lot harder to track. As has been said, very easy to crack. Very much a case of:
Make it annoying for the Hackers, but as unobtrusive as possible for the Users