Can I make a read-only symlink in Windows?

Question

I have two game accounts in a game that allows addons. The addons save their data into files. Whenever the game is closed (from a manual close, a disconnect, a crash, etc.), the game writes to the specific account's data file. So, for any given addon, each account has a separate data file.

What I'd like to accomplish is to share the data between both accounts while allowing only one of the accounts to write data to the file. While I could purposely log them out in a particular order to make sure that the correct account is the one that actually writes to the file, I don't always have control over logouts in the event of server or client crashes.

Let's say the data files are arranged like this:

C:\Games\GameTitle\Data\PrimaryAccount\addonDataFile.txt C:\Games\GameTitle\Data\SecondaryAccount\addonDataFile.txt

I would like the first file to be treated like the second file while being read, but to deny any writes to the second file when an attempt is made to write to it. As far as I'm aware, a symlink in Windows only meets the first criteria.

Is there a way to make a read-only symlink to a file, preventing writes from being made via the symlink?

score 3 · Answer 1 · edited Mar 20 '17 at 10:17

I'm afraid there is no good solution to this question as presented, in that File permissions tie to the file object itself in NTFS (in the MFT$), so any given file has only one set of permissions, even if there are multiple links to it. Permissions on links are very limited, and apply to the link/junction itself, not the target object, with one exception: denying file listing on a junction will prevent the user from seeing any file within the junction.

Instead I recommend dynamically switching the permissions, or the readonly bit when launching your game, depending on which account you intend to use. You could do so by creating two batch files, which set the file to writable or readonly, and then launch the game.

the simplest approach would be to use the readonly bit:

Batch #1

#Readonly user
attrib +R c:\path\to\file.ext
c:\path\to\game.exe

Batch #2

#ReadWrite user
attrib -R c:\path\to\file.ext
c:\path\to\game.exe

Some executables may attempt to turn off the read only bit if they have trouble writing to a file they want, so if these batch files are not sufficient, try denying your windows user write access instead, using the cacls command. it would be somthing like:

Batch #1

#Readonly user
CACLS c:\path\to\file.ext /E /P "Username":R
c:\path\to\game.exe

Batch #2

#ReadWrite user
CACLS c:\path\to\file.ext /E /P "Username":F
c:\path\to\game.exe

Then finally, to make it all easier to use, just create game short cuts for each account, and point them to the appropriate batch file.

As I said, its unfourtunate that there is no clean solution to this issue, but this is a pretty marginal case, and the technology was just never designed to work as you would like. hopefully this somewhat hackish approach will work for you though.

Can I make a read-only symlink in Windows?

1 Answers1