93

Is there a way to see a list of all the symbolic links that are active on a Windows machine?


I have accepted @JoachimOtahal's answer as it works within a single second and I think provided what I needed when the questionw as asked.

Former accepted answer wrapped in timing code:

C:\Windows\System32> cmd /E /C "prompt $T$$ & echo.%TIME%$ & dir /AL /S C:\ | find "SYMLINK" & for %Z in (.) do rem/ "
22:01:17.00$
06/05/2021  08:26 AM    <SYMLINKD>     All Users [C:\ProgramData]
06/14/2021  04:57 PM    <SYMLINK>      DEFAULTUSER_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\DEFAULT]
06/14/2021  04:57 PM    <SYMLINK>      SAM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SAM]
06/14/2021  04:57 PM    <SYMLINK>      SECURITY_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SECURITY]
06/14/2021  04:57 PM    <SYMLINK>      SOFTWARE_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SOFTWARE]
06/14/2021  04:57 PM    <SYMLINK>      SYSTEM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SYSTEM]
06/14/2021  04:57 PM    <SYMLINK>      DEFAULTUSER_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\DEFAULT]
06/14/2021  04:57 PM    <SYMLINK>      SAM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SAM]
06/14/2021  04:57 PM    <SYMLINK>      SECURITY_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SECURITY]
06/14/2021  04:57 PM    <SYMLINK>      SOFTWARE_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SOFTWARE]
06/14/2021  04:57 PM    <SYMLINK>      SYSTEM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SYSTEM]
05/22/2021  09:02 AM    <SYMLINKD>     All Users [C:\ProgramData]
06/14/2021  04:57 PM    <SYMLINK>      DEFAULTUSER_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\DEFAULT]
06/14/2021  04:57 PM    <SYMLINK>      SAM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SAM]
06/14/2021  04:57 PM    <SYMLINK>      SECURITY_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SECURITY]
06/14/2021  04:57 PM    <SYMLINK>      SOFTWARE_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SOFTWARE]
06/14/2021  04:57 PM    <SYMLINK>      SYSTEM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SYSTEM]
02/26/2021  03:15 AM    <SYMLINKD>     Downloads [E:\Downloads\]

22:01:38.69$ rem/

Accepted PS7 answer with giving different results within a second: https://superuser.com/a/1652788/68111

6 Answers 6

12

$_.Linktype misses Symlinks. $_.Attributes misses Hardlinks. Junctions are listed in both properties. -Force is needed else hidden symlinks are skipped. Full working example which gets symlinks, junctions and hardlinks:

Get-ChildItem -Path "C:\Windows\","c:\","$env:USERPROFILE" -Force |
    Where-Object { $_.LinkType -ne $null -or $_.Attributes -match "ReparsePoint" } |
    ft FullName,Length,Attributes,Linktype,Target

The output looks like this - in my case I made a junction just to show how it should look like. Be aware: PS still has a bug not showing the target of Symlinks, check this for more information: https://stackoverflow.com/questions/16926127/powershell-to-resolve-junction-target-path

PS D:\> Get-ChildItem -Path "C:\Windows\","c:\","$env:USERPROFILE" -Force |
    Where-Object { $_.LinkType -ne $null -or $_.Attributes -match "ReparsePoint" } |
    ft FullName,Length,Attributes,Linktype,Target


FullName                                     Length                                                 Attributes LinkType Target                                                                                                  
--------                                     ------                                                 ---------- -------- ------                                                                                                  
C:\Windows\bfsvc.exe                          79360                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.17763.1518_no...
C:\Windows\DfsrAdmin.exe                     232960                                                    Archive HardLink {C:\Windows\WinSxS\msil_dfsradmin_31bf3856ad364e35_10.0.17763.529_none_86a482ce47ce0e6b\DfsrAdmin.exe...
C:\Windows\explorer.exe                     4389168                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.17763.1911_none_9f01b4994bb...
C:\Windows\HelpPane.exe                     1072128                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.17763.1911_none_b9659da9...
C:\Windows\hh.exe                             18432                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.17763.1697_none_15caed9d569...
C:\Windows\mib.bin                            43131                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-snmp-mgmt-api_31bf3856ad364e35_10.0.17763.1_none_dc5249570...
C:\Windows\notepad.exe                       254464                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.17763.1697_none_bc8f846641e0...
C:\Windows\regedit.exe                       357888                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.17763.1697_none_41a3...
C:\Windows\splwow64.exe                      133632                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.17763.1697_non...
C:\Windows\twain_32.dll                       64512                                                    Archive HardLink {C:\Windows\WinSxS\wow64_microsoft-windows-w..ion-twaincomponents_31bf3856ad364e35_10.0.17763.1_none_...
C:\Windows\WindowsShell.Manifest                670                                  ReadOnly, Hidden, Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-shell32_31bf3856ad364e35_10.0.17763.1_none_5cef14c36a2559b...
C:\Windows\winhlp32.exe                       11776                                                    Archive HardLink {C:\Windows\WinSxS\wow64_microsoft-windows-winhstb_31bf3856ad364e35_10.0.17763.1_none_2420a29095f0ffc...
C:\Windows\WMSysPr9.prx                      316640                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-wmvsdk_31bf3856ad364e35_10.0.17763.1_none_96f1...
C:\Windows\write.exe                          11264                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-write_31bf3856ad364e35_10.0.17763.1_none_5048bc153541494b\...
C:\BackupPlatte                                                                        Directory, ReparsePoint Junction {Volume{6072e7bc-2cae-11e9-b57a-bc5ff4e5c991}\}                                                         
C:\Dokumente und Einstellungen                      Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Programme                                        Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Anwendungsdaten              Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Cookies                      Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Druckumgebung                Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Eigene Dateien               Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Lokale Einstellungen         Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Netzwerkumgebung             Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Recent                       Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\SendTo                       Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Startmenü                    Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Vorlagen                     Hidden, System, Directory, ReparsePoint, NotContentIndexed            

Simple mod to dig down to what I was like in serach of (-and $_.Length -eq 1) Powershell 7 + only:

PS > Get-ChildItem -Path "C:\Windows\","c:\","$env:USERPROFILE" -Force |
  Where-Object { $_.LinkType -ne $null -or $_.Attributes -match "ReparsePoint" -and $_.Length -eq 1 } |
  ft FullName,Attributes,Linktype,Target

FullName                                                                        Attributes LinkType     Target
--------                                                                        ---------- --------     ------
C:\Documents and Settings       Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Application Data Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Cookies          Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Downloads                                           Directory, ReparsePoint SymbolicLink {E:\Downloads\}
C:\Users\Louis\iCloudDrive                      ReadOnly, Directory, Archive, ReparsePoint              {}
C:\Users\Louis\Local Settings   Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\My Documents     Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\NetHood          Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\PrintHood        Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Recent           Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\SendTo           Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Start Menu       Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Templates        Hidden, System, Directory, ReparsePoint, NotContentIndexed
3
  • Nice cleanup, consider it yours. It's going to be hard to beat the instant output. In PS 7.1.3 I do get Length 1 of what I am looking for and this is also a bonus. Are you using PS5, I see your linked directories have their lengths omitted? Jul 7, 2021 at 1:10
  • @LouisWaweru Directories have no length, not even length "0". But I want the size when the target is a file! Therefore I explicitly include length. Your example excludes all hardlinks in C:\Windows ? I think it would be better to remove your edit from my comment, and add your own. As far as PS is concerned: This is PS 5.1 code, compatible down to Windows 7 / 2008 R2, and up to Server 2022. I never tested this with PS 7.x. BTW: If you only want directories exclude " -or $_.Attributes -match "ReparsePoint"" - Hardlinked directories are not possible. Jul 8, 2021 at 11:24
  • That’s some strange PS7 behavior. It lists them when I use AND -eq 1 for length Jul 8, 2021 at 11:35
125

Try the following command:

dir /AL /S C:\
  • /A displays all files with a specific attribute, and L specifies reparse points (symlinks and directory junctions)
  • /S makes the command recursive
  • replace C:\ with the drive letter you want to scan, or with a path if you don't want to scan an entire drive
1
  • 8
    Is there a way to make it not recurse into symlinks / junctions so that it doesn't get stuck in an infinite loop? Oct 12, 2014 at 1:09
30

In PowerShell

Get-ChildItem -Path C:\ -Force -Recurse -ErrorAction 'silentlycontinue' | 
  Where { $_.Attributes -match "ReparsePoint"}
  • -Force includes hidden and system files
  • -Recurse gets all child items
  • -ErrorAction 'silentlycontinue' suppresses Access to the path XYZ is denied errors
  • Where { $_.Attributes -match "ReparsePoint"} checks folders and files if it's a junction

Explanation of Mode and Attributes:

PS > Get-ChildItem | SELECT Mode,Attributes -Unique

Mode                    Attributes
----                    ----------
d----                    Directory
d---s            System, Directory
d---- Directory, NotContentIndexed
d----        Directory, Compressed
la---                      Archive
-a---                      Archive
lar--            ReadOnly, Archive
-a---          Archive, Compressed
5
  • 1
    Thanks -- this could be really powerful for scripting -- is there a property that displays where the link goes to? -- it doesn't seem to be displayed by default, but if it's there we could script against it and that would be awesome. Oct 12, 2014 at 1:11
  • 3
    @BrainSlugs83 To get the target of ReparsePoints programmatically , read this SO answer
    – nixda
    Dec 4, 2014 at 23:38
  • How to just get the ones create by the current user and not the OS?
    – boardtc
    Jan 15, 2020 at 17:14
  • @BrainSlugs83 Safe, mono/Xamarin friendly? New in System.IO: LinkTarget pointed out by marin: stackoverflow.com/a/70762343/434034 Apr 7, 2022 at 7:04
  • What's the meaning of NotContentIndexed?
    – not2qubit
    Nov 22, 2023 at 15:47
14

There's also a handy program for that called NTFSLinksView.

Edit: there's also SageLinks, this one checks the validity too.

2
  • 1
    NirSoft strikes again! After downloading NirCmd, I was overwhelmed with the other stuff he had and figured I should just be grateful he had NirCmd.
    – aschultz
    Nov 26, 2020 at 9:03
  • 1
    Yeah, he’s saved me from losing many a credential. I’m sure NirSoft’s other programs are just as nicely packaged hacker knowledge. Jun 25, 2021 at 5:54
5

I know this answer is late, but here's perhaps something closer to what you were probably looking for:

dir /AL /S C:\ | find "SYMLINK"
4
  • 2
    Of course this will also show files and directories that have SYMLINK in their name. Sep 25, 2018 at 0:38
  • @Scott but if this is identical to the accepted answer, then all those folders regardless of their name will be symbolic links.
    – Mark C
    Apr 17, 2020 at 7:42
  • @MarkC: Ah, in my haste to comment (over 1½ years ago), I failed to notice that this was Indrek’s answer plus a garnish, and I failed to register the /AL.  Still, Indrek’s answer explains that /AL specifies listing reparse points (which include symlinks and directory junctions), and so it becomes a question of definitions.  If you (IMHO, incorrectly) consider directory junctions to be a type of symlink, then this answer is wrong because it filters out directory junctions like Local Settings, My Documents and My Pictures.  … (Cont’d) Apr 17, 2020 at 17:13
  • 2
    (Cont’d) …  If you consider directory junctions not to be a type of symlink, then this answer is wrong because it shows directory junctions that have SYMLINK in their name. (And it can be fixed just by changing it to find "<SYMLINK".) Apr 17, 2020 at 17:13
3

In windows, files can NOT have character < or > in the file name, and so no file can include "<SYMLINKD>" in the file name. The proper way to search for symbolic links only is to specify "<SYMLINKD>" in the find option.

dir /AL /S C:\ | find "<SYMLINKD>"

Same goes for junction points:

dir /AL /S C:\ | find "<JUNCTION>"

Even when looking for both symbolic links and junction points, I still recommend using the find with just "<", so as to avoid displaying summaries.

dir /AL /S C:\ | find "<"

The /B option (dir /AL /B C:\) can also exclude the summary, but that also removes the reparsepoint address.

2
  • This answer worked well for me whereas the accepted answer did not find the SYMLINKD folders that I had created with MKLINK /D from the command prompt.
    – Ben
    Feb 25, 2022 at 5:32
  • This worked well, but how to get rid of circular references? Dec 25, 2022 at 19:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .