Ask HN: Are (Windows) Symlinks Dangerous?

3 points

9 years ago

What I'm trying to do: I have a central repository of scripts and I figured that symlinks would be a novel way to keep scripts located throughout my network always up to date. I ran into an issue during a Windows deployment where I got the following error "The symbolic link cannot be followed because its type is disabled." This is the default behavior on Windows for remote to local and remote to remote symbolic links.

I can enable this functionality with fsutil, but I want to know the potential repercussions of doing so. If this is a bad idea, what methods or tools do you guys use to keep your scripts up to date?

Background: In the Unix/Linux world hardlinks and symlinks are par for the course, but Microsoft hides this functionality in Windows (though it is present). Microsoft disables the functionality for non-administrators by default and obscures it from users by making it possible only through the command-line.

Notes: I know things can "break" when symlinks point to symlinks and I know that some programs (e.g. backup) may choke on them or just not follow them.

Discussion on Information Security: https://security.stackexchange.com/questions/10194/why-do-you-have-to-be-an-admin-to-create-a-symlink-in-windows

Discussion on Superuser: https://superuser.com/questions/10727/why-cant-normal-users-on-windows-create-symbolic-links

Here's one of the Windows STIGs about preventing symlinks for users: https://www.stigviewer.com/stig/windows_7/2014-04-02/finding/V-26482

Previous thread on Hacker News: https://news.ycombinator.com/item?id=3075408

Thread on /r/sysadmin: https://www.reddit.com/r/sysadmin/comments/5jdq2d/windows_discussion_are_symlinks_dangerous/