Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In linux every user can create symlinks, but in Windows I need an admin command line, or mklink fails. Why is that?

share|improve this question
Indeed, why? Might be the references, by default enabled in programming languages like MS C#, is a vulnerability?! – Val Mar 8 '13 at 19:44
What's worse, hard links and directory junctions can be created by regular users AFAIK, just not symlinks. This restriction seems really arbitrary. – Ajedi32 Oct 30 '15 at 15:44
See also:… – Ajedi32 Oct 30 '15 at 15:44
up vote 14 down vote accepted

By default, only administrators can create symbolic links, because they are the only ones who have the SeCreateSymbolicLinkPrivilege privilege found under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\ granted.

Symbolic links (symlinks) can expose security vulnerabilities in applications that aren't designed to handle symbolic links.


share|improve this answer
I'd love to read more details about these security vulnerabilities. – ripper234 Dec 29 '11 at 10:51
@ripper234 Maybe something like this. – ordag Dec 29 '11 at 11:53
I wonder how people buy "this is not allowed because this is not allowed" as the answer to the question "why this is not allowed?". When you say that SeCreateSymbolicLinkPrivilege rule prohibits this, you give exactly this stupid answer. Might be this is "Rule of law" mentality: when people hear a rule they stop thinking. – Val Mar 8 '13 at 19:23
@Val Totally agree. The "SeCreateSymbolicLinkPrivilege" part explains HOW the rule is enforced, it doesn't explain WHY the rule exists in the first place. Now, the "security vulnerabilites" part does explain why admin rights were deemed necessary, and for me that's the only relevant part of this answer. – Pedro Rodrigues Mar 12 '14 at 17:21
From what I understand, Symlink Racing is a vulnerability that was patched at the kernel level in Linux some time ago: Is Windows still vulnerable? Is that why only admin users have this privilege? If so, why not just fix the problem instead of introducing stupid restrictions like this? – Ajedi32 Oct 30 '15 at 15:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.