Can an NTFS junction point be followed over a network share?

Question

OS: Windows Server 2016

If i have a folder X containing a junction point to another folder Y (on same machine and same volume). Then if i share X over the network, will a remote user that connects to X be redirected to Y?

The use case is that the folder location/name Y is changing now and then after the execution of a scheduled task. But I'd like that the remote users always use the same network share name (X). I could update the junction point during the execution of the task.

Is there any other tech with which i could achieve this? I had some success with the following method: I recreate or update a network share named X and have it point directly to Y. But this only works if X is a top-level share.

I'm looking for a solution that also works in the following case: Let X be a share to Y. Then if Y contains a subfolder A, remote users can access it via the network path X\A. But i also need the case where via a network pathm say X\B, remote users should be able to access a completely different path on the machine. Hence my idea to create a junction point from Y\B to another path. (which remote users would access via X\B)

Is it possible?

Answer 1

Yes, the SMB fileserver will automatically follow directory junctions (mklink /j) transparently, even if the target points outside a shared folder. (Tested experimentally.)

On the other hand, the server will not follow symlinks (mklink /d) – they're left to the client, which will not follow them by default either (and if you enable this option, the target obviously must be another shared folder). See harrymc's post for more information.

As a third option, on Windows Server you can create a share as a DFS namespace, under which you can have both regular files and special "referral" directories which may point to another share – even on another server. (These referral are always followed client-side, and they are recognized by all Windows versions; libsmbclient; and even Linux cifs.ko.)

DFS is probably the preferred option if folder Y will ever need to be moved to a different machine. (It doesn't require Active Directory, although common authentication across all fileservers does make things easier.)

Answer 2

The default client Windows is to disallow chains of symbolic links.

The command that controls that behavior is fsutil, further documented in the article Fsutil behavior.

The specific behavior you are looking for is named SymlinkEvaluation. You may see its current value by entering in a Command Prompt the command fsutil behavior query SymlinkEvaluation. The following are the defaults on my Windows 10:

The behavior codes for SymlinkEvaluation have the names of L2L, L2R, R2L, and R2R, meaning the following:

• L stands for "Local", and R for "Remote"
• The FIRST L or R - before the 2 - refers to the location of the link itself (not to its target) relative to the machine ACCESSING the link.
• The SECOND L or R - after the 2 - refers to the location of the link's target relative to the machine where the LINK itself is located.

For example, setting SymlinkEvaluation R2L means that you can control access to links:

• located on a remote machine (R)
• that point to targets on that same remote machine (L)

Thus the possibilities are:

1. Local to local symbolic links, L2L:{0|1}
2. Local to remote symbolic links, L2R:{0|1}
3. Remote to local symbolic links, R2R:{0|1}
4. Remote to remote symbolic links, R2L:{0|1}

where 0 stands for disabled and 1 stands for enabled.

The command you might be looking for is:

fsutil behavior set SymlinkEvaluation R2L:1

Just remember that this is to be done on the client, not on the server.

Answer 3

September 2022: Junctions over network share seems to have stopped working.

https://learn.microsoft.com/en-us/sysinternals/downloads/junction

Last update: 7/19/2022

Note

Windows does not support junctions to directories on remote shares.

In the past I created junctions on my network share server, pointing to a different drive. Everything worked okay. I haven't used it for a while until now, but things broke.

• On the client side, Double-clicking on the junction icon gives no reaction -- nothing shows up or changes.
• On client side, "Properties" shows the junction as a folder, but it has 0 bytes and 0 files.
• Right-clicking the icon and selecting "Open in new window" gives no reaction.
• Neither "Map network drive" or directly going to \server\share worked

On server side, doing these did not help:

• Setting up a new share for the junction target.
• Starting over, creating new junction, new share, reset "Security" tab

Windows 10 Pro 21H2 19044.1889 Windows Feature Experience Pack 120.2212.4180.0

Kudos to The Great Microsoft for breaking another productivity feature.