mklink permission on windows 8

Question

I need to create symbolic links via mklink as an user, not as an administrator. I have set via secpol.msc and Security Settings → Local Policies → User Rights Assignment rule Create Symbolic links to user, that is currently logged in. After that I have restarted my laptop and tried to create symlink.

I still get the error: You do not have sufficient privilege to perform this operation.

The strange thing is that when I create junction (mklink /d /j ...) it works fine. For other mklink operations does not.

So the question is simple, how can I need to set permissions in windows 8 to get mklink work properly under user, not administrator?

Thank you for help.

Redcoat

This link may be useful. – Ephesus

OMG, quite strange solution, but it solved my problem. Thank you very much. For others quick summary: the user, that runs mklink can not be administrator at the same time. Create non admin user and use runas to perform mklink without need of administrator. – Redcoat

pretty strange, my question is: what is the vulnerability that this restriction mitigates? – Ethe

Answer 1

You can create symbolic links in non-elevated command prompt ONLY if you have enabled SeCreateSymbolicLink policy for user AND user doesn't belong to Administrators group

Jato

Answer 2

User Account Control requires elevation for commands that can link accross SMB boundaries.

Junction does not require elevation as it cannot link accross.

The only way around this that springs to mind is disabling UAC or to RunAs an admin. I do not recommend this.

Solange

You're right. And nobody in century XXI should disable UAC to workaround something... it's really a bad idea. – Baucom

I hasten to add I do not recommend ever disabling UAC unless you have masochistic tendancies – Solange

Answer 3

I found this way works:

1. Find 'Command Prompt'.
2. Right click on it.
3. On the menu that comes up, click 'Run as Administrator'.

Now type in the command.

The command is mklink /d "{the link where you want the symlink to be}\{the name of the symlink}" "{link to the actual folder}"

Blotchy