Symbolic link creation always requires elevation on Windows

[lzybkr]

Creating a symbolic link does not require elevation on Windows 10 if developer mode is enabled, but only if the link is created with SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE (see the docs). PowerShell appears to not pass this flag.

Steps to reproduce

In an unelevated session:

$target = New-TemporaryFile
New-Item -Name tmpsymlink -Target $target -Type SymbolicLink

Expected behavior

Link is created

Actual behavior

PS C:\Users\jason> $target = New-TemporaryFile
>> New-Item -Name tmpsymlink -Target $target -Type SymbolicLink
New-Item : Administrator privilege required for this operation.

Environment data

> $PSVersionTable
Name                           Value
----                           -----
PSVersion                      6.1.0
PSEdition                      Core
GitCommitId                    6.1.0
OS                             Microsoft Windows 10.0.17763
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

[jacktose]

Am I missing something, or is this still an issue on Win 10 2004? Developer mode enabled.

PS C:\Users\jack\Desktop\lntest> New-Item -Path "link.txt" -ItemType SymbolicLink -Value "target.txt"
New-Item : Administrator privilege required for this operation.
At line:1 char:1
+ New-Item -Path "link.txt" -ItemType SymbolicLink -Value "target.txt"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (C:\Users\jack\Desktop\lntest\target.txt:String) [New-Item], Unauthori
   zedAccessException
    + FullyQualifiedErrorId : NewItemSymbolicLinkElevationRequired,Microsoft.PowerShell.Commands.NewItemCommand

PS C:\Users\jack\Desktop\lntest> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.19041.1
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.19041.1
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

[aodhneine]

Still an issue on Windows 10 21390.1, with developer mode activated.

PS C:\Users\Freya\bin> New-Item -ItemType SymbolicLink -Target git-2.31.1\bin\git.exe -Path git.exe
New-Item : Administrator privilege required for this operation.
At line:1 char:1
+ New-Item -ItemType SymbolicLink -Target git-2.31.1\bin\git.exe -Path  ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (C:\Users\Freya\...1.1\bin\git.exe:String) [New-Item], UnauthorizedAcc
   essException
    + FullyQualifiedErrorId : NewItemSymbolicLinkElevationRequired,Microsoft.PowerShell.Commands.NewItemCommand

PS C:\Users\Freya\bin> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.21390.1
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.21390.1
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

[iSazonov]

Now new .Net API follow this.
See File.CreateSymbolicLink
https://github.com/dotnet/runtime/blob/a1b391bde7ef9e58c19f217ed367c8e8fea7cac3/src/libraries/Common/src/Interop/Windows/Kernel32/Interop.CreateSymbolicLink.cs#L45-L48

So we can consider replacing internal PowerShell code with the new API.

GitHub

runtime/Interop.CreateSymbolicLink.cs at a1b391bde7ef9e58c19f217ed367c8e8fea7cac3 · dotnet/runtime

.NET is a cross-platform runtime for cloud, mobile, desktop, and IoT apps. - runtime/Interop.CreateSymbolicLink.cs at a1b391bde7ef9e58c19f217ed367c8e8fea7cac3 · dotnet/runtime

[AndrewSav]

The .Net API gives "A required privilege is not held by the client", when you are an administrator and not running an elevated PowerShell. I'm on Win 10 build 19044. Powershell 7.2.7

[jacktose]

Yep, still an issue:

PS C:\Users\jacktose\Desktop> New-Item -Path "link.txt" -ItemType SymbolicLink -Value "target.txt"
New-Item: Administrator privilege required for this operation.

PS C:\Users\jacktose\Desktop> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.3.9
PSEdition                      Core
GitCommitId                    7.3.9
OS                             Microsoft Windows 10.0.22631
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

[jacktose]

Hello @microsoft-github-policy-service @iSazonov, this is still an issue. Should we to open a new issue instead of keeping this one? That can't be good “housekeeping.”

[victormachado-ada-tech]

Please I just want to create a simple symlink without requiring administrator permission. What are the security concerns about creating a symlink? Why is it required to be admin to use this tool?

[jacktose]

@lzybkr Can you reopen it again and stop the bot somehow?

[lzybkr]

I don't know anything about the bot.
Using 7.4, it seems to work without running as admin, so maybe it was fixed?

[zaragozamartin91]

Issue still exists in Windows 10 + PowerShell v7.4.2

Message New-Item: Administrator privilege required for this operation. is yielded from the terminal.

$PSVersionTable prompt:

Name                           Value
----                           -----
PSVersion                      7.4.2
PSEdition                      Core
GitCommitId                    7.4.2
OS                             Microsoft Windows 10.0.19045
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0