How can I grant a particular user the permission to create symlinks in Windows 7?

I've searched through "Group Policy" and Google, but haven't found anything.

On a side note, is there a way to search through everything in Group Policy Editor? The filters only seem to work on particular subtrees. I never actually found anything using the filters.

  • 2
    BTW Does anybody know why creating symlinks requires admin permissions? What is so dangerous in them?
    – Monsignor
    Jul 13, 2017 at 18:58
  • 2
    @Monsignor: I saw a long time ago that Microsoft claimed too many programs couldn't handle them safely. Anyway I'm rather annoyed that they require elevation to use.
    – Joshua
    Aug 24, 2017 at 16:25

2 Answers 2

  1. Open the Local Group Policy Editor : Run>gpedit.msc. If that doesn't work try secpol.msc (Note, Windows Home users might need to enable group-policy-editor first).

  2. Go to (Windows Pro users might don't see the first two items ) :

    Computer configuration → Windows SettingsSecurity Settings → Local Policies → User Rights Assignment and edit the Create symbolic links.

    enter image description here

  3. Add the user or group that you want to allow to create symbolic links.

  4. If you've added your own user account, you need to log out and log in back in for the change to have an effect.

Note: This setting has no effect on user accounts that belong to the Administrators group. Those users will always have to run mklink in an elevated environment (as Administrator) because of the way UAC removes privileges when creating an non-elevated access token. There is a handy Excel reference sheet for finding group policy settings: Group Policy Settings Reference for Windows and Windows Server

  • 14
    Here it looked more like the following, just for reference if someone gets confused: Control Panel > Administrative Tools > Local Security Policy > Local Policies > User Rights Assignment > Create symbolic links And by the way you need to logout and login again for the settings to apply.
    – Seldaek
    May 17, 2010 at 19:23
  • 5
    And you can run secpol.msc to skip the first part, then all you got left is : Local Policies > User Rights Assignment > Create symbolic links
    – Seldaek
    May 17, 2010 at 20:11
  • 5
    Also: Running "gpupdate /force" from either CMD or just the Run dialog should apply the setting as well. Jan 21, 2011 at 8:21
  • 2
    Any way to do the same via registry for Microsoft-hated-non-Windows-8-Pro users? gpedit.msc is not available to them
    – szx
    Jun 5, 2015 at 18:39
  • 6
    re - "Those users will always have to run mklink in an elevated environment (as Administrator)"... so administrators are always having to run with elevated... arg. Feb 14, 2016 at 15:06

Some windows configurations miss gpedit.msc. In this case You can try as an alternative:

  1. running this PowerShell script from here:
    function addSymLinkPermissions($accountToAdd){
        Write-Host "Checking SymLink permissions.."
        $sidstr = $null
        try {
            $ntprincipal = new-object System.Security.Principal.NTAccount "$accountToAdd"
            $sid = $ntprincipal.Translate([System.Security.Principal.SecurityIdentifier])
            $sidstr = $sid.Value.ToString()
        } catch {
            $sidstr = $null
        Write-Host "Account: $($accountToAdd)" -ForegroundColor DarkCyan
        if( [string]::IsNullOrEmpty($sidstr) ) {
            Write-Host "Account not found!" -ForegroundColor Red
            exit -1
        Write-Host "Account SID: $($sidstr)" -ForegroundColor DarkCyan
        $tmp = [System.IO.Path]::GetTempFileName()
        Write-Host "Export current Local Security Policy" -ForegroundColor DarkCyan
        secedit.exe /export /cfg "$($tmp)" 
        $c = Get-Content -Path $tmp 
        $currentSetting = ""
        foreach($s in $c) {
            if( $s -like "SECreateSymbolicLinkPrivilege*") {
                $x = $s.split("=",[System.StringSplitOptions]::RemoveEmptyEntries)
                $currentSetting = $x[1].Trim()
        if( $currentSetting -notlike "*$($sidstr)*" ) {
            Write-Host "Need to add permissions to SymLink" -ForegroundColor Yellow

            Write-Host "Modify Setting ""Create SymLink""" -ForegroundColor DarkCyan

            if( [string]::IsNullOrEmpty($currentSetting) ) {
                $currentSetting = "*$($sidstr)"
            } else {
                $currentSetting = "*$($sidstr),$($currentSetting)"
            Write-Host "$currentSetting"
        $outfile = @"
    [Privilege Rights]
    SECreateSymbolicLinkPrivilege = $($currentSetting)
        $tmp2 = [System.IO.Path]::GetTempFileName()
            Write-Host "Import new settings to Local Security Policy" -ForegroundColor DarkCyan
            $outfile | Set-Content -Path $tmp2 -Encoding Unicode -Force
            Push-Location (Split-Path $tmp2)
            try {
                secedit.exe /configure /db "secedit.sdb" /cfg "$($tmp2)" /areas USER_RIGHTS 
            } finally { 
        } else {
            Write-Host "NO ACTIONS REQUIRED! Account already in ""Create SymLink""" -ForegroundColor DarkCyan
            Write-Host "Account $accountToAdd already has permissions to SymLink" -ForegroundColor Green
            return $true;
  1. download polsedit which looks like freeware alternative to gpedit.msc

Then run gpupdate /force to apply changes immediately

  • 3
    Besides giving the source. please add the script in case the source is no longer present.
    – miroxlav
    Feb 9, 2017 at 15:50
  • 1
    Windows Starter Edition, Home and Home Premium do not include gpedit.msc. Instructions to install it are in my question & answer Windows Starter Edition, Home and Home Premium do not include gpedit, how do I install it?
    – DavidPostill
    Feb 10, 2017 at 15:46
  • 1
    this is why I prefer unix
    – CervEd
    Apr 8, 2022 at 8:30
  • @CervEd: This is probably off-topic, but even if I like *nix systems too, I have seen commercial Unix tools that were also artificially restricted (accordingly to the license price the paid for the particular installation). So I prefer to say: "This is why I love F/LOSS *nix software" :)
    – saulius2
    Sep 16, 2023 at 22:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .