Windows – Give an application symlink permissions within a directory in Windows

permissionssymbolic-linkwindows

I don't know much about Windows permissions, but is there a way to give a script or application permission to create symlinks that link only within a a directory tree that say an application "owns"?
(The links live in the tree. So do the targets.)

Note: I do not want to give the script admin rights.

Best Answer

Nothing built in, sorry. You could give the user who is running the process (be it yourself or some other account) the SeSymbolicLink privilege, which would enable creating symlinks without giving other Admin-level access. The symlinks would still only be creatable anywhere that account could otherwise create a file, and normal access checks would still apply (if the symlink pointed to a file you can read but not write, you'd be able to read it through the symlink but still wouldn't be able to write to it). That's hopefully safe enough; the only reason symlinks require a special privilege on Windows at all is because they weren't available until Vista, so lots of legacy programs don't handle them properly especially for things like directory loops or other such bad ideas.

To enable a given user to create symlinks (by giving the user SeSymbolicLinkPrivilege), do the following:

  1. Run the Local Security Policy Editor (secpol.msc). It will require Administrator access.
  2. Look under "Local Policies" -> "User Rights Assignment". Find the "Create symbolic links" entry.
  3. Double-click the entry to open it, then press [Add User or Group...].
  4. In the box that appears, type your Windows username and press [Check Names]. It should change to a fully-qualified name, with an underline. If it doesn't, you should try other forms of the username. You can also click [Advanced] to search a list of options.
  5. Once the user name is underlined in the box, hit [OK] on the "Select Users and Groups" window, then hit [OK] on the "Create symbolic link Properties" window.
  6. If the user in question is logged in, log out and log in again. That user should now be able to create symbolic links without needing admin privileges.

Another option is to use NTFS hard links. Unlike symlinks, any user is allowed to create a hard link (by default). However, also unlike symlinks (and unlike POSIX hardlinks), you can't create a hardlink unless you have a specific permission (Write Attributes? Something in the general category of "Write") on the destination file. Thus, if you only need to link files (not directories), and you have write access to the files in question, you can probably use hardlinks just fine (they operate like POSIX hardlinks, following the file node rather than the file name, and if you delete the "original file" but not the link, the data is not deleted until you also delete the link).

If you need directory linking too, you can - as @WesSayeed suggests - use NTFS junctioons. They're harder to create programmatically (though easy from a script) but work fine for most purposes that you might normally use a directory symlink for.

Related Question