How to remove only delete permission about symlink from usual user on Windows

Question

We have a program which makes temporary directory HT on %USERPROFILE%\AppData\Local\Tempand working on there, and delete the temporary directory when I quit the program. I want to make the program generate its temporary diretory not on Temp but SSD partition F:\Somewhere.

Unfortunately, the program does not have any settings that to change the temporary directory. This environment(Windows) is installed in HDD, and have SSD partition. (I can't install Windows on SSD because of some problems.)

So, I think I make symlink HT on %USERPROFILE%\AppData\Local\Temp which direct to F:\Somewhere. It seems to be worked. However, I couldn't prevent the program delete the symlink HT. In other words, I need to make symlink again and again after I quit the program.

How can I prevent deleting the symlink from the program?

Solution that I tried

I tried to remove deleting permission about symlink %USERPROFILE%\AppData\Local\Temp\HT from usual user (The program is running by usual user, not UAC-upgraded user).

From Property -> Security -> Advanced(?, my environment is Japanese, but seems to be advanced) 1. Disable permission inheritance 2. Add Reject policy about delete permission for usual user, Administrator, and system

But the program could delete the symlink.

Summarized Question

How can I prevent deleting symlink to directory from the program which runs not on admin authority?

P.S. sorry for not-usual words. I'm using Japanese windows, so I couldn't found properly matching English phrase.

Additional notes

• I do not want to change Temp directory to another directory/partition completely. Just the directory HT only under ~~/Temp/HT.

Answer 1

Changing the permissions on the symbolic link doesn't work because the "delete subfolders and files" right on the parent directory takes precedence over any permissions on the symlink itself. I do not recommend modifying the permissions on the parent directory in this case, since a lot of software depends on the temporary directory and any changes to the permissions could cause problems that in many cases would be quite difficult to diagnose.

Instead, you can set the read-only flag on the symlink. Note that you must do this from the command line, because the Windows Explorer GUI does not support use of the read-only flag for directories (see footnote). These commands should work:

cd /d %temp%
attrib /L +r HT

You may also need to change the permissions to prevent the symlink from being moved or having the read-only flag reset:

icacls HT /L /deny Everyone:(M)

There is still a risk that the software will respond badly to the inability to remove the symlink, e.g., by crashing. There's nothing much you can do in that case, other than trying to set things up so that the symlink is automatically recreated as necessary, but fortunately this is rare.

Footnote:

Explorer also doesn't show the read-only flag for directories, and will even go so far as to advise the user that the read-only flag has no effect on directories, which is true from a certain point of view, I suppose, since it doesn't stop the directory from being renamed or moved or the contents being changed as one might have expected. All that the read-only flag does is to prevent an empty directory (or a directory symlink, regardless of whether the target is empty) from being removed, but in this particular case that's exactly what is needed.

Side note:

The specific access rights that need to be blocked are Write Attributes (WA) to prevent the read-only flag being reset and Synchronize (S) to prevent the symlink from being, e.g., moved to the Recycle Bin. It should be noted that this approach will only work as desired with a directory symlink, not an ordinary directory, because the Synchronize right is required to access the contents of a directory. There does not appear to be any way in NTFS to prevent an ordinary directory from being moved without changing the permissions on the parent.

Answer 2

%USERPROFILE%\AppData\Local\Temp is the default value for the TMP and the TEMP environment variable. Most probably The application is using this variable to get the temp dir.

Just set the variable to F:\, for example by launching it through a .bat file, and your symlink should not be needed anymore.