24

Beginning with Windows Vista, NTFS gained the ability to represent symbolic links to files (as opposed to directory junctions). Also cmd gained the mklink command.

However, non-administrative users can't create symbolic links by default. Why may that be so?

I mean, what kind of damage could a user do with symlinks he/she can't do with hardlinks or directory junctions (both of which can be created without administrative privileges without problems)?

Joey
  • 40,002
  • 15
  • 104
  • 126

2 Answers2

12

Symlinks are actually less dangerous than hardlinks, true. I don't think the issue here is security, but administrative efficiency. I think Microsoft made the right decision as it will drive system administrators nuts when users start to create symlinks everywhere without knowing what they are doing.

In Mac OS, shortcuts are symlinks. So conceptually it's less confusing, since it's been like that since the beginning. And for Linux fans, you don't need to be told what symlinks are. ;-)

But it's not true for Windows. Imagine explaining to the average user the difference between a good old Windows shortcut, a symlink and directory junction/hardlink, and you'll soon realize that giving such power to the masses will be opening a huge can of wriggly tech support worms.

Peter Mortensen
  • 12,090
  • 23
  • 70
  • 90
GeneQ
  • 4,957
  • 2
  • 36
  • 53
  • 4
    and that's why windows ain't for SUPERusers :-) – Sander Versluys Jul 22 '09 at 12:30
  • 34
    Actually, *finding* the `mklink` command is probably something the average user won't ever do. So the only kind of "link" a normal user will ever face is Ye Olde Shell Link. So for the great majority of users there wouldn't be a *need* of explaining symlinks vs. shell links vs. reparse points as there is (rightfully so, probably) no easily accessible method of creating other kinds of links. Still, that doesn't really explain why normal users can create hardlinks and junction points but no symlinks. I'd really like to, sometimes. – Joey Jul 22 '09 at 12:48
  • Good point Johannes. – GeneQ Jul 22 '09 at 12:53
  • Since this is wiki, let's make this the super answer. – random Jul 22 '09 at 13:22
  • 2
    I consider myself a power user, yet until this question, I thought junctions ARE symlinks! (any link for the difference between them and symlinks?) – hasen Jul 24 '09 at 06:22
  • hasen j: Junction points are effectively the same as symlinks but they only work for directories. Until Vista there was no way to symlink individual files. Although the new symlinks also work for directories: http://hypftier.de/dump/link.txt – Joey Jul 24 '09 at 20:42
  • The biggest danger is that creating an infinite loop. Users would have to restrict themselves to creating a link to a parent node, which would cause a program that is traversing subdirectories to go in circles. – surfasb Jul 06 '11 at 18:25
-1

I know this is an ancient question, but it deserves an updated answer.

Microsoft's documentation says "Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them."

That sounds like a pretty good reason not to allow 'normal' Windows users to create them.

Mark Barnes
  • 405
  • 1
  • 5
  • 13
  • 3
    That explains nothing. All that says is "You can't do it because we have a rule saying you can't do it." Why though? What are the security vulnerabilities exactly? – Adambean Jul 30 '21 at 13:26