4

Is it possible to have Unix guest on Windows 10 host and use symbolic links in Virtualbox shared folders without administrator priviledges?

I'm asking because previously symbolic links on Windows 10 required administator priviledges but now it's possible to enable Developer mode to create symbolic links using standard account and mklink. Thus it make sense there would be a way use the Developer mode to lift the administrator requirement on symbolic links in shared folders as well.

5
  • 1
    SeCreateSymbolicLinkPrivilege doesn't require administrator access. If it's provided only by administrator access, then it gets filtered out of the token for a non-elevated UAC logon. But an administrator can grant it to a user, group, or well-known group such as "Authenticated Users", in which case it won't be filtered out.
    – Eryk Sun
    Commented May 28, 2019 at 15:25
  • Thanks eryksun. Giving a user SeCreateSymbolicLinkPrivilege doesn't even require the Developer mode. The only issue is that my user account is in administrator group so I would need to create another account and then switch back and forth between the new and the current account. Commented May 29, 2019 at 12:17
  • 1
    I grant the privilege to "Authenticated Users". Everyone that logs on with credentials is in this group. With this in place, an administrator doesn't have to elevate to create symbolic links.
    – Eryk Sun
    Commented May 29, 2019 at 12:31
  • My computer is a single user laptop not connected to a domain, so wouldn't that mean I'd need to create a second account which is not in Administrator group and that would then get the priviledge granted to "Authenticated Users"? But then every time I need admin priviledges I would need to switch to the other admin account. This doesn't sound very convenient or am I missing something here? Commented May 29, 2019 at 12:41
  • 1
    Run whoami /groups to see what groups your account has and what state they're in. Run it non-elevated and elevated, and compare. You should have the "Authenticated Users" group (S-1-5-11) enabled in both cases.
    – Eryk Sun
    Commented May 29, 2019 at 13:01

1 Answer 1

5

Short answer is yes. It is possible to use symbolic links in Virtualbox shared folders without administrator priviledges and it doesn't even require the Developer Mode.

Here are the step-by-step instructions how to do it, thanks eryksun for helping me out!

  1. Launch Local Security Policy app from start menu (or Win+R, then type secpol.msc)
  2. Navigate to Local Policies -> User Rights Assignment
  3. Open Create symbolic links property. By default it has only Administrators listed.
  4. Click Add User or Group... and write Authenticated Users to the Enter the object names to select field to grant the symbolic link priviledge to all users who log on with credetials
  5. Close the windows by clicking OKs and log off and log on
  6. Now symbolic links are working in VirtualBox shared folders without administrator priviledges!

Instructions how to grant the symbolic links priviledge

The Developer Mode didn't help here even though it enables the use of symbolic links without elevated access in two ways:

  1. mklink command can be used without elevated access
  2. CreateSymbolicLink API can be used without elevated access if you pass dwFlags option SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE

Since even after enabling the Developer Mode VirtualBox has to be run as Administrator in order to create symlinks I assume the method 2 i.e. API calls are used to create the symlinks. Thus VirtualBox code would need to be updated to use the SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE flag. After that update enabling Developer Mode should be sufficient to enable symbolic links in shared folders.

4
  • The Windows API added SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE so applications can selectively enable it, but it's annoying to use because it's an invalid parameter in older versions of Windows. I'd prefer either an opt-in manifest setting or API call to allow creating unprivileged symlinks in developer mode, rather than providing the option on a per-call basis.
    – Eryk Sun
    Commented May 30, 2019 at 3:07
  • 1
    Also note that when you are using shared folders in this way, the symbolic link is resolved by the host, not the guest. VirtualBox hands the request over to the host's filesystem. Commented Oct 24, 2019 at 14:22
  • 1
    Samuli Asmala, this might not work for Windows 10 Home. I added to your ticket #18680 in the hopes that the VirtualBox team can work out a trivial fix for this.
    – algofoogle
    Commented Apr 2, 2022 at 12:49
  • Just allowing Authenticated Users to create links was not enough for me. It was also needed to execute command on the host: VBoxManage.exe setextradata "MyVM" VBoxInternal2/SharedFoldersEnableSymlinksCreate/MyShare 1 to enable creating links on specific share. See virtualbox.org/manual/… for more
    – tutejszy
    Commented Jan 3, 2023 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.