Windows 10: Any security risks with granting everyone permissions to create symbolic links?

Why is the ability to create symlinks in windows restricted to administrators?

And are there any security risks in granting that permissions to all users?

:)

 

How to create a Symbolic Link on Windows 10?

How do I create junctions or directory symbolic links in Windows 10?

Note: For reference, the link in the question refers to the following commands.

Create a junction:

Create a directory symbolic link:

You can use either mklink /j or junction in Windows 10 to create junctions.

You can use mklink /d in Windows 10 to create directory symbolic links.

Notes:

• junction can also list junctions and determine if a file is a junction unlike mklink.
  
• mklink is an internal command only available within a cmd shell.
  
• By default Administrator privileges are required to create symbolic links.
  
  It can also be granted to other users. The security setting "Create symbolic links" can be granted at:
  
  

Examples

Using mklink to create a directory symbolic link:

Using mklink to create a junction:

Using junction to create a junction:

It seems like the junction command has been retired in Windows 10.

You can download junction from Windows SysInternals (which is part of Microsoft):

Further Reading

• An A-Z Index of the Windows CMD command line - An excellent reference for all things Windows cmd line related.
  
• mklink - Create a symbolic link to a directory or a file, or create a hard file link or directory junction.
  

 

Create symbolic links policy doesn't work

If I go the the Local Security Policy, and enable Create symbolic links for "Users" or any specific user, it will never be applied.

I've tried forcing an update of this policy: gpupdate / force to no avail. Loggin out & back in doesn't help either. After this, I test the policy by going to a command prompt and entering
mklink anyfile.tx c:\path\to\any\file.txt and get the result:
You do not have sufficient privilege to perform this operation.

This is a bug.

The policy has been added for the correct user, and in the directory in question I have full control permission. There's no logical reason why Windows refuses to give the the permission to create symbolic links.

I can create symbolic links in an elevated command prompt. However, this is undesirable for various reasons that aren't relevant to the problem.

I sure hope Microsoft (are you listenening in?) is going to fix this problem and release an update. It's clearly a bug.

Unless there's something else I need to do to give myself the permission to create sybolic links. If so, please tell me the EXACT circumstances that need to apply for this to happen.

 

mklink /D - symbolic link created but file access is denied via the link

I have literally the same problem. I could create symbolic links of folders with no problem from a specific disk to another until recently.

Now symbolic links from that disk to folders on other disks don't work anymore. Access denied.

Interestingly symbolic links on other disks to folders on other disks work. So do symbolic links on the problematic disk to
files on other disks - just not symbolic folder links.

The problem is really just with symbolic folder links on one specific disk.

The permissions and integrity level of the disk in question are exactly the same as the other disks that don't produce this problem.

Something is still different with the disk in question. But what could it be ?

What exactly happens when a symbolic link to a folder (not a file) is created ? And what happens when that folder link is being used to access other folders within the remote location ?

Cause frankly it is curious that once a folder link is accessed that accessing a folder within that link would produce the error "Location is not available - The system cannot move the file to a different disk drive."

Why is it trying to move a file to a different drive ? After all I'm just listing folder contents.

Mind you the symbolic link to the folder on another disk lets me access the folder (list its contents), but i cannot access the files within the folder or even open other folders within the link.