01/11/2025

[Windows 11] Disable lnk resolver

Windows has a set of features on NTFS file systems called "shortcut resolver" that allow the system to search for a shortcut target in the filesystem if it gets moved around after a link to it is created.

This is convenient normally in case you create a shortcut to something, then move said something somewhere else as usually the shortcut would stop working and throw an error when accessed instead. However, it can lead to security issues as a new attack vector is introduced that could allow a malicious actor to hijack the target and point to something unwanted instead.

The features can be disabled on Windows 11 by enabling some group policies (Start->Run->gpedit.msc):

  • User Configuration\Administrative Templates\Start Menu and Taskbar\Do not use the search-based method when resolving shell shortcuts
  • User Configuration\Administrative Templates\Start Menu and Taskbar\Do not use the tracking-based method when resolving shell shortcuts
  • User Configuration\Administrative Templates\Windows Components\File Explorer\Do not track shell shortcuts during roaming
Additionally the "Distributed Link Tracking Client" service can be disabled (Start->Run->services.msc)

No comments:

Post a Comment

With great power comes great responsibility