95

Is there a way to see a list of all the symbolic links that are active on a Windows machine?

I have accepted @JoachimOtahal's answer as it works within a single second and I think provided what I needed when the questionw as asked.

Former accepted answer wrapped in timing code:

C:\Windows\System32> cmd /E /C "prompt $T$$ & echo.%TIME%$ & dir /AL /S C:\ | find "SYMLINK" & for %Z in (.) do rem/ "
22:01:17.00$
06/05/2021  08:26 AM    <SYMLINKD>     All Users [C:\ProgramData]
06/14/2021  04:57 PM    <SYMLINK>      DEFAULTUSER_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\DEFAULT]
06/14/2021  04:57 PM    <SYMLINK>      SAM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SAM]
06/14/2021  04:57 PM    <SYMLINK>      SECURITY_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SECURITY]
06/14/2021  04:57 PM    <SYMLINK>      SOFTWARE_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SOFTWARE]
06/14/2021  04:57 PM    <SYMLINK>      SYSTEM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SYSTEM]
06/14/2021  04:57 PM    <SYMLINK>      DEFAULTUSER_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\DEFAULT]
06/14/2021  04:57 PM    <SYMLINK>      SAM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SAM]
06/14/2021  04:57 PM    <SYMLINK>      SECURITY_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SECURITY]
06/14/2021  04:57 PM    <SYMLINK>      SOFTWARE_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SOFTWARE]
06/14/2021  04:57 PM    <SYMLINK>      SYSTEM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SYSTEM]
05/22/2021  09:02 AM    <SYMLINKD>     All Users [C:\ProgramData]
06/14/2021  04:57 PM    <SYMLINK>      DEFAULTUSER_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\DEFAULT]
06/14/2021  04:57 PM    <SYMLINK>      SAM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SAM]
06/14/2021  04:57 PM    <SYMLINK>      SECURITY_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SECURITY]
06/14/2021  04:57 PM    <SYMLINK>      SOFTWARE_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SOFTWARE]
06/14/2021  04:57 PM    <SYMLINK>      SYSTEM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SYSTEM]
02/26/2021  03:15 AM    <SYMLINKD>     Downloads [E:\Downloads\]

22:01:38.69$ rem/

Accepted PS7 answer with giving different results within a second: https://superuser.com/a/1652788/68111

Louis Waweru
  • 25,409
  • 45
  • 137
  • 203

7 Answers7

128

Try the following command:

dir /AL /S C:\
  • /A displays all files with a specific attribute, and L specifies reparse points (symlinks and directory junctions)
  • /S makes the command recursive
  • replace C:\ with the drive letter you want to scan, or with a path if you don't want to scan an entire drive
Indrek
  • 24,874
31

In PowerShell

Get-ChildItem -Path C:\ -Force -Recurse -ErrorAction 'silentlycontinue' | 
  Where { $_.Attributes -match "ReparsePoint"}
  • -Force includes hidden and system files
  • -Recurse gets all child items
  • -ErrorAction 'silentlycontinue' suppresses Access to the path XYZ is denied errors
  • Where { $_.Attributes -match "ReparsePoint"} checks folders and files if it's a junction

Explanation of Mode and Attributes†:

PS > Get-ChildItem | SELECT Mode,Attributes -Unique

Mode                    Attributes




d----                    Directory
d---s            System, Directory
d---- Directory, NotContentIndexed
d----        Directory, Compressed
la---                      Archive
-a---                      Archive
lar--            ReadOnly, Archive
-a---          Archive, Compressed
P-L
  • 157
nixda
  • 27,634
16

$_.Linktype misses Symlinks. $_.Attributes misses Hardlinks. Junctions are listed in both properties. -Force is needed else hidden symlinks are skipped. Full working example which gets symlinks, junctions and hardlinks:

Get-ChildItem -Path "C:\Windows\","c:\","$env:USERPROFILE" -Force |
    Where-Object { $_.LinkType -ne $null -or $_.Attributes -match "ReparsePoint" } |
    ft FullName,Length,Attributes,Linktype,Target

The output looks like this - in my case I made a junction just to show how it should look like. Be aware: PS still has a bug not showing the target of Symlinks, check this for more information: https://stackoverflow.com/questions/16926127/powershell-to-resolve-junction-target-path

PS D:\> Get-ChildItem -Path "C:\Windows\","c:\","$env:USERPROFILE" -Force |
    Where-Object { $_.LinkType -ne $null -or $_.Attributes -match "ReparsePoint" } |
    ft FullName,Length,Attributes,Linktype,Target

FullName                                     Length                                                 Attributes LinkType Target




C:\Windows\bfsvc.exe                          79360                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.17763.1518_no...
C:\Windows\DfsrAdmin.exe                     232960                                                    Archive HardLink {C:\Windows\WinSxS\msil_dfsradmin_31bf3856ad364e35_10.0.17763.529_none_86a482ce47ce0e6b\DfsrAdmin.exe...
C:\Windows\explorer.exe                     4389168                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.17763.1911_none_9f01b4994bb...
C:\Windows\HelpPane.exe                     1072128                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.17763.1911_none_b9659da9...
C:\Windows\hh.exe                             18432                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.17763.1697_none_15caed9d569...
C:\Windows\mib.bin                            43131                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-snmp-mgmt-api_31bf3856ad364e35_10.0.17763.1_none_dc5249570...
C:\Windows\notepad.exe                       254464                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.17763.1697_none_bc8f846641e0...
C:\Windows\regedit.exe                       357888                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.17763.1697_none_41a3...
C:\Windows\splwow64.exe                      133632                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.17763.1697_non...
C:\Windows\twain_32.dll                       64512                                                    Archive HardLink {C:\Windows\WinSxS\wow64_microsoft-windows-w..ion-twaincomponents_31bf3856ad364e35_10.0.17763.1_none_...
C:\Windows\WindowsShell.Manifest                670                                  ReadOnly, Hidden, Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-shell32_31bf3856ad364e35_10.0.17763.1_none_5cef14c36a2559b...
C:\Windows\winhlp32.exe                       11776                                                    Archive HardLink {C:\Windows\WinSxS\wow64_microsoft-windows-winhstb_31bf3856ad364e35_10.0.17763.1_none_2420a29095f0ffc...
C:\Windows\WMSysPr9.prx                      316640                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-wmvsdk_31bf3856ad364e35_10.0.17763.1_none_96f1...
C:\Windows\write.exe                          11264                                                    Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-write_31bf3856ad364e35_10.0.17763.1_none_5048bc153541494b...
C:\BackupPlatte                                                                        Directory, ReparsePoint Junction {Volume{6072e7bc-2cae-11e9-b57a-bc5ff4e5c991}}

C:\Dokumente und Einstellungen                      Hidden, System, Directory, ReparsePoint, NotContentIndexed

C:\Programme                                        Hidden, System, Directory, ReparsePoint, NotContentIndexed

C:\Users\Administrator\Anwendungsdaten              Hidden, System, Directory, ReparsePoint, NotContentIndexed

C:\Users\Administrator\Cookies                      Hidden, System, Directory, ReparsePoint, NotContentIndexed

C:\Users\Administrator\Druckumgebung                Hidden, System, Directory, ReparsePoint, NotContentIndexed

C:\Users\Administrator\Eigene Dateien               Hidden, System, Directory, ReparsePoint, NotContentIndexed

C:\Users\Administrator\Lokale Einstellungen         Hidden, System, Directory, ReparsePoint, NotContentIndexed

C:\Users\Administrator\Netzwerkumgebung             Hidden, System, Directory, ReparsePoint, NotContentIndexed

C:\Users\Administrator\Recent                       Hidden, System, Directory, ReparsePoint, NotContentIndexed

C:\Users\Administrator\SendTo                       Hidden, System, Directory, ReparsePoint, NotContentIndexed

C:\Users\Administrator\Startmenü                    Hidden, System, Directory, ReparsePoint, NotContentIndexed

C:\Users\Administrator\Vorlagen                     Hidden, System, Directory, ReparsePoint, NotContentIndexed

Simple mod to dig down to what I was like in serach of (-and $_.Length -eq 1) Powershell 7 + only:

PS > Get-ChildItem -Path "C:\Windows\","c:\","$env:USERPROFILE" -Force |
  Where-Object { $_.LinkType -ne $null -or $_.Attributes -match "ReparsePoint" -and $_.Length -eq 1 } |
  ft FullName,Attributes,Linktype,Target

FullName                                                                        Attributes LinkType     Target




C:\Documents and Settings       Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Application Data Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Cookies          Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Downloads                                           Directory, ReparsePoint SymbolicLink {E:\Downloads}
C:\Users\Louis\iCloudDrive                      ReadOnly, Directory, Archive, ReparsePoint              {}
C:\Users\Louis\Local Settings   Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\My Documents     Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\NetHood          Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\PrintHood        Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Recent           Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\SendTo           Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Start Menu       Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Templates        Hidden, System, Directory, ReparsePoint, NotContentIndexed
Louis Waweru
  • 25,409
  • 45
  • 137
  • 203
Joachim Otahal
  • 794
14

There's also a handy program for that called NTFSLinksView.

Edit: there's also SageLinks, this one checks the validity too.

colin lamarre
  • 277
5

I know this answer is late, but here's perhaps something closer to what you were probably looking for:

dir /AL /S C:\ | find "SYMLINK"
c D
  • 59
3

In windows, files can NOT have character < or > in the file name, and so no file can include "<SYMLINKD>" in the file name. The proper way to search for symbolic links only is to specify "<SYMLINKD>" in the find option.

dir /AL /S C:\ | find "<SYMLINKD>"

Same goes for junction points:

dir /AL /S C:\ | find "<JUNCTION>"

Even when looking for both symbolic links and junction points, I still recommend using the find with just "<", so as to avoid displaying summaries.

dir /AL /S C:\ | find "<"

The /B option (dir /AL /B C:\) can also exclude the summary, but that also removes the reparsepoint address.

David Maisonave
  • 31
0

Nice simple Windows app that instantly shows symlinks and their type:

https://github.com/raspopov/SageLinks

Just noticed that this is also mentioned above.

Peter Jay
  • 3