How do I grant SeCreateSymbolicLink on Windows Vista Home edition

Question

I want to be able to use mklink to create symbolic links on my Windows Vista Home edition computer.

However, I must grant SeCreateSymbolicLink before mklink will be able to function on Vista Home edition (by default the right is revoked).

Home edition provides no UI or tool facility to grant/revoke discreet rights.

A Wikipedia link on NTFS symbolic links says the ntrights.exe tool that comes in Windows Server 2003 Resource Kit Tools can be used to grant this right on Home edition. However, after installing these tools, that proved to be incorrect. That version of ntrights.exe does not recognize SeCreateSymbolicLink and Microsoft's web site does not show any update available for this particular resource kit tool.

Is there a PowerShell script way to do this? Or any other tool/technique that might be feasible to use on Vista Home edition?

Ruthful

I stopped doing Windows programming years ago and don't bother to install Visual Studio, etc., as in recent years I spend my time developing developing server software in Java and client stuff in Adobe Flex/AIR. Just hoping there's a pre-existing tool solution so that I don't have to crack into Win API programming again - yuk. – Ruthful

It's been a long time since this question was posted, but the linked Wikipedia article no longer mentions ntrights.exe. – Cambodia

Answer 1

polsedit

_{(source: southsoftware.com)}
"Polsedit is a freeware utility that allows you to modify user policies such as user account rights and user privileges on a local or remote Windows NT-based system. This can be useful when for some reason you are unable ro run secpol.msc snap-in, for example, XP Home and Vista Home do not have secpol.msc at all. The user interface of Polsedit is very similar to the standard policies editor from Windows, but it also displays some internal data, which can be useful for developers."

Lingulate

Hmm, a nice, straight forward tool that is better than the typical convoluted admin tool UIs that Microsoft tends to provide. – Ruthful

Answer 2

How about running secpol.msc and granting the Create symbolic links permission to the group or users. By default this permission is granted only to Administrators group.

From the programming side, it looks that you need SE_CREATE_SYMBOLIC_LINK_NAME priviledge or its text variant: SeCreateSymbolicLinkPrivilege. More details in msdn

secpol.msc - Create Symbolick Links permission http://blog.i18n.ro/wp-content/uploads/2010/01/policy_create_symbolic_links.png

Unmeet

Thank doesn't work for me. Still gives me privilege error. I even added "Everyone", and did a reboot in case the policy wasn't being applied yet, still doesn't work. The only way I have ever gotten mklink to work is by "run as administrator" - which makes it hard to script :( – Stingy

Same issue for me :( Myself, everyone, whatever! This annoying OS does not let me do symlinks... – Xerophyte

@Stingy I too am getting this issue! It seems as if this policy is completely useless. Have you found a solution yet? – Raul

@Fred Simon Or yourself? I'm quite desperate to get this working! – Raul

@Raul No, I never did find a solution. I had to abandon that particular approach to my problem. Sorry! – Stingy

@Matt: No problem. In fact, you may be interested to know that a bit more searching revealed that the New-symlink and New-junction commands in the PowerShell Community Extensions (PSCX) project are capable of creating symlinks/junctions without elevation. :-) – Raul

For me this works. mklink is allowd as command when I add my username to the list within secpol.msc – Preliminaries

Answer 3

German language

• Win+r secpol.msc
• locate "Sicherheitseinstellungen\Lokale Richtlinien\Zuweisen von Benutzerrechten"
• Add the user to "Erstellen symbolischer Verknüpfungen"

Dutch language

• Win+r secpol.msc
• locate "Beveiligingsinstellingen\Lokaal beleid>Toewijzen van gebruikersrechten"
• Add the user to "Symbolische koppeling maken"

Preliminaries