View a list of symbolic links on system?

Question

Is there a way to see a list of all the symbolic links that are active on a Windows machine?

I have accepted @JoachimOtahal's answer as it works within a single second and I think provided what I needed when the questionw as asked.

Former accepted answer wrapped in timing code:

C:\Windows\System32> cmd /E /C "prompt $T$$ & echo.%TIME%$ & dir /AL /S C:\ | find "SYMLINK" & for %Z in (.) do rem/ "
22:01:17.00$
06/05/2021  08:26 AM    <SYMLINKD>     All Users [C:\ProgramData]
06/14/2021  04:57 PM    <SYMLINK>      DEFAULTUSER_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\DEFAULT]
06/14/2021  04:57 PM    <SYMLINK>      SAM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SAM]
06/14/2021  04:57 PM    <SYMLINK>      SECURITY_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SECURITY]
06/14/2021  04:57 PM    <SYMLINK>      SOFTWARE_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SOFTWARE]
06/14/2021  04:57 PM    <SYMLINK>      SYSTEM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SYSTEM]
06/14/2021  04:57 PM    <SYMLINK>      DEFAULTUSER_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\DEFAULT]
06/14/2021  04:57 PM    <SYMLINK>      SAM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SAM]
06/14/2021  04:57 PM    <SYMLINK>      SECURITY_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SECURITY]
06/14/2021  04:57 PM    <SYMLINK>      SOFTWARE_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SOFTWARE]
06/14/2021  04:57 PM    <SYMLINK>      SYSTEM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SYSTEM]
05/22/2021  09:02 AM    <SYMLINKD>     All Users [C:\ProgramData]
06/14/2021  04:57 PM    <SYMLINK>      DEFAULTUSER_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\DEFAULT]
06/14/2021  04:57 PM    <SYMLINK>      SAM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SAM]
06/14/2021  04:57 PM    <SYMLINK>      SECURITY_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SECURITY]
06/14/2021  04:57 PM    <SYMLINK>      SOFTWARE_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SOFTWARE]
06/14/2021  04:57 PM    <SYMLINK>      SYSTEM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SYSTEM]
02/26/2021  03:15 AM    <SYMLINKD>     Downloads [E:\Downloads\]

22:01:38.69$ rem/

Accepted PS7 answer with giving different results within a second: https://superuser.com/a/1652788/68111

Louis Waweru · Accepted Answer · 2021-07-07 02:09:14Z

$_.Linktype misses Symlinks. $_.Attributes misses Hardlinks. Junctions are listed in both properties. -Force is needed else hidden symlinks are skipped. Full working example which gets symlinks, junctions and hardlinks:

Get-ChildItem -Path "C:\Windows\","c:\","$env:USERPROFILE" -Force |
    Where-Object { $_.LinkType -ne $null -or $_.Attributes -match "ReparsePoint" } |
    ft FullName,Length,Attributes,Linktype,Target

The output looks like this - in my case I made a junction just to show how it should look like. Be aware: PS still has a bug not showing the target of Symlinks, check this for more information: https://stackoverflow.com/questions/16926127/powershell-to-resolve-junction-target-path

PS D:\> Get-ChildItem -Path "C:\Windows\","c:\","$env:USERPROFILE" -Force |
    Where-Object { $_.LinkType -ne $null -or $_.Attributes -match "ReparsePoint" } |
    ft FullName,Length,Attributes,Linktype,Target


FullName                                     Length                                                 Attributes LinkType Target                                                                                                  
--------                                     ------                                                 ---------- -------- ------                                                                                                  
C:\Windows\bfsvc.exe                          79360                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.17763.1518_no...
C:\Windows\DfsrAdmin.exe                     232960                                                    Archive HardLink {C:\Windows\WinSxS\msil_dfsradmin_31bf3856ad364e35_10.0.17763.529_none_86a482ce47ce0e6b\DfsrAdmin.exe...
C:\Windows\explorer.exe                     4389168                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.17763.1911_none_9f01b4994bb...
C:\Windows\HelpPane.exe                     1072128                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.17763.1911_none_b9659da9...
C:\Windows\hh.exe                             18432                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.17763.1697_none_15caed9d569...
C:\Windows\mib.bin                            43131                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-snmp-mgmt-api_31bf3856ad364e35_10.0.17763.1_none_dc5249570...
C:\Windows\notepad.exe                       254464                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.17763.1697_none_bc8f846641e0...
C:\Windows\regedit.exe                       357888                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.17763.1697_none_41a3...
C:\Windows\splwow64.exe                      133632                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.17763.1697_non...
C:\Windows\twain_32.dll                       64512                                                    Archive HardLink {C:\Windows\WinSxS\wow64_microsoft-windows-w..ion-twaincomponents_31bf3856ad364e35_10.0.17763.1_none_...
C:\Windows\WindowsShell.Manifest                670                                  ReadOnly, Hidden, Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-shell32_31bf3856ad364e35_10.0.17763.1_none_5cef14c36a2559b...
C:\Windows\winhlp32.exe                       11776                                                    Archive HardLink {C:\Windows\WinSxS\wow64_microsoft-windows-winhstb_31bf3856ad364e35_10.0.17763.1_none_2420a29095f0ffc...
C:\Windows\WMSysPr9.prx                      316640                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-wmvsdk_31bf3856ad364e35_10.0.17763.1_none_96f1...
C:\Windows\write.exe                          11264                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-write_31bf3856ad364e35_10.0.17763.1_none_5048bc153541494b\...
C:\BackupPlatte                                                                        Directory, ReparsePoint Junction {Volume{6072e7bc-2cae-11e9-b57a-bc5ff4e5c991}\}                                                         
C:\Dokumente und Einstellungen                      Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Programme                                        Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Anwendungsdaten              Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Cookies                      Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Druckumgebung                Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Eigene Dateien               Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Lokale Einstellungen         Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Netzwerkumgebung             Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Recent                       Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\SendTo                       Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Startmenü                    Hidden, System, Directory, ReparsePoint, NotContentIndexed                                                                                                                  
C:\Users\Administrator\Vorlagen                     Hidden, System, Directory, ReparsePoint, NotContentIndexed

Simple mod to dig down to what I was like in serach of (-and $_.Length -eq 1) Powershell 7 + only:

PS > Get-ChildItem -Path "C:\Windows\","c:\","$env:USERPROFILE" -Force |
  Where-Object { $_.LinkType -ne $null -or $_.Attributes -match "ReparsePoint" -and $_.Length -eq 1 } |
  ft FullName,Attributes,Linktype,Target

FullName                                                                        Attributes LinkType     Target
--------                                                                        ---------- --------     ------
C:\Documents and Settings       Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Application Data Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Cookies          Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Downloads                                           Directory, ReparsePoint SymbolicLink {E:\Downloads\}
C:\Users\Louis\iCloudDrive                      ReadOnly, Directory, Archive, ReparsePoint              {}
C:\Users\Louis\Local Settings   Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\My Documents     Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\NetHood          Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\PrintHood        Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Recent           Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\SendTo           Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Start Menu       Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Templates        Hidden, System, Directory, ReparsePoint, NotContentIndexed

Nice cleanup, consider it yours. It's going to be hard to beat the instant output. In PS 7.1.3 I do get Length 1 of what I am looking for and this is also a bonus. Are you using PS5, I see your linked directories have their lengths omitted? — Louis Waweru, Jul 7, 2021 at 1:10
@LouisWaweru Directories have no length, not even length "0". But I want the size when the target is a file! Therefore I explicitly include length. Your example excludes all hardlinks in C:\Windows ? I think it would be better to remove your edit from my comment, and add your own. As far as PS is concerned: This is PS 5.1 code, compatible down to Windows 7 / 2008 R2, and up to Server 2022. I never tested this with PS 7.x. BTW: If you only want directories exclude " -or $_.Attributes -match "ReparsePoint"" - Hardlinked directories are not possible. — Joachim Otahal, Jul 8, 2021 at 11:24
That’s some strange PS7 behavior. It lists them when I use AND -eq 1 for length — Louis Waweru, Jul 8, 2021 at 11:35

Indrek · Accepted Answer · 2012-10-30 11:51:10Z

121

Try the following command:

dir /AL /S C:\

/A displays all files with a specific attribute, and L specifies reparse points (symlinks and directory junctions)
/S makes the command recursive
replace C:\ with the drive letter you want to scan, or with a path if you don't want to scan an entire drive

edited Oct 30, 2012 at 11:51

answered Oct 30, 2012 at 11:44

Indrek

24.1k14 gold badges89 silver badges93 bronze badges

8

Is there a way to make it not recurse into symlinks / junctions so that it doesn't get stuck in an infinite loop?
– BrainSlugs83
Oct 12, 2014 at 1:09

Add a comment |

P-L · Accepted Answer · 2022-06-01 00:42:17Z

28

In PowerShell

Get-ChildItem -Path C:\ -Force -Recurse -ErrorAction 'silentlycontinue' | 
  Where { $_.Attributes -match "ReparsePoint"}

-Force includes hidden and system files
-Recurse gets all child items
-ErrorAction 'silentlycontinue' suppresses Access to the path XYZ is denied errors
Where { $_.Attributes -match "ReparsePoint"} checks folders and files if it's a junction

Explanation of Mode and Attributes†:

PS > Get-ChildItem | SELECT Mode,Attributes -Unique

Mode                    Attributes
----                    ----------
d----                    Directory
d---s            System, Directory
d---- Directory, NotContentIndexed
d----        Directory, Compressed
la---                      Archive
-a---                      Archive
lar--            ReadOnly, Archive
-a---          Archive, Compressed

edited Jun 1, 2022 at 0:42

P-L

1577 bronze badges

answered Mar 26, 2014 at 20:23

nixda

26.6k17 gold badges108 silver badges156 bronze badges

1

Thanks -- this could be really powerful for scripting -- is there a property that displays where the link goes to? -- it doesn't seem to be displayed by default, but if it's there we could script against it and that would be awesome.
– BrainSlugs83
Oct 12, 2014 at 1:11
3

@BrainSlugs83 To get the target of ReparsePoints programmatically , read this SO answer
– nixda
Dec 4, 2014 at 23:38
How to just get the ones create by the current user and not the OS?
– boardtc
Jan 15, 2020 at 17:14
@BrainSlugs83 Safe, mono/Xamarin friendly? New in System.IO: LinkTarget pointed out by marin: stackoverflow.com/a/70762343/434034
– Louis Waweru
Apr 7, 2022 at 7:04

Add a comment |

colin lamarre · Accepted Answer · 2017-12-07 04:19:05Z

14

There's also a handy program for that called NTFSLinksView.

Edit: there's also SageLinks, this one checks the validity too.

edited Dec 7, 2017 at 4:19

answered Nov 7, 2017 at 9:03

colin lamarre

2571 gold badge3 silver badges8 bronze badges

1

NirSoft strikes again! After downloading NirCmd, I was overwhelmed with the other stuff he had and figured I should just be grateful he had NirCmd.
– aschultz
Nov 26, 2020 at 9:03
1

Yeah, he’s saved me from losing many a credential. I’m sure NirSoft’s other programs are just as nicely packaged hacker knowledge.
– Louis Waweru
Jun 25, 2021 at 5:54

Add a comment |

c D · Accepted Answer · 2018-09-24 23:45:00Z

5

I know this answer is late, but here's perhaps something closer to what you were probably looking for:

dir /AL /S C:\ | find "SYMLINK"

answered Sep 24, 2018 at 23:45

c D

591 silver badge1 bronze badge

2

Of course this will also show files and directories that have SYMLINK in their name.
– Scott - Слава Україні
Sep 25, 2018 at 0:38
@Scott but if this is identical to the accepted answer, then all those folders regardless of their name will be symbolic links.
– Mark C
Apr 17, 2020 at 7:42
@MarkC: Ah, in my haste to comment (over 1½ years ago), I failed to notice that this was Indrek’s answer plus a garnish, and I failed to register the /AL. Still, Indrek’s answer explains that /AL specifies listing reparse points (which include symlinks and directory junctions), and so it becomes a question of definitions. If you (IMHO, incorrectly) consider directory junctions to be a type of symlink, then this answer is wrong because it filters out directory junctions like Local Settings, My Documents and My Pictures. … (Cont’d)
– Scott - Слава Україні
Apr 17, 2020 at 17:13
2

(Cont’d) … If you consider directory junctions not to be a type of symlink, then this answer is wrong because it shows directory junctions that have SYMLINK in their name. (And it can be fixed just by changing it to find "<SYMLINK".)
– Scott - Слава Україні
Apr 17, 2020 at 17:13

Add a comment |

David Maisonave · Accepted Answer · 2021-11-26 00:56:42Z

2

In windows, files can NOT have character < or > in the file name, and so no file can include "<SYMLINKD>" in the file name. The proper way to search for symbolic links only is to specify "<SYMLINKD>" in the find option.

dir /AL /S C:\ | find "<SYMLINKD>"

Same goes for junction points:

dir /AL /S C:\ | find "<JUNCTION>"

Even when looking for both symbolic links and junction points, I still recommend using the find with just "<", so as to avoid displaying summaries.

dir /AL /S C:\ | find "<"

The /B option (dir /AL /B C:\) can also exclude the summary, but that also removes the reparsepoint address.

edited Nov 26, 2021 at 0:56

answered Nov 26, 2021 at 0:32

David Maisonave

213 bronze badges

This answer worked well for me whereas the accepted answer did not find the SYMLINKD folders that I had created with MKLINK /D from the command prompt.
– Ben
Feb 25, 2022 at 5:32
This worked well, but how to get rid of circular references?
– omegastripes
Dec 25, 2022 at 19:47

Add a comment |

Stack Exchange Network

View a list of symbolic links on system?

Former accepted answer wrapped in timing code:

Accepted PS7 answer with giving different results within a second: https://superuser.com/a/1652788/68111

6 Answers 6

In PowerShell

Your Answer

Not the answer you're looking for? Browse other questions tagged
windows
ntfs
symbolic-link
or ask your own question.

Linked

Hot Network Questions

View a list of symbolic links on system?

Former accepted answer wrapped in timing code:

Accepted PS7 answer with giving different results within a second: https://superuser.com/a/1652788/68111

6 Answers 6

In PowerShell

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged windowsntfssymbolic-link or ask your own question.

Linked

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
windows
ntfs
symbolic-link
or ask your own question.