有没有办法查看 Windows 机器上所有活动的符号链接的列表?
我接受了@JoachimOtahal 的回答,因为它在一秒钟内就起作用了,而且我认为它在回答问题时提供了我所需要的内容。
以前接受的答案包裹在时间代码中:
C:\Windows\System32> cmd /E /C "prompt $T$$ & echo.%TIME%$ & dir /AL /S C:\ | find "SYMLINK" & for %Z in (.) do rem/ "
22:01:17.00$
06/05/2021 08:26 AM <SYMLINKD> All Users [C:\ProgramData]
06/14/2021 04:57 PM <SYMLINK> DEFAULTUSER_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\DEFAULT]
06/14/2021 04:57 PM <SYMLINK> SAM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SAM]
06/14/2021 04:57 PM <SYMLINK> SECURITY_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SECURITY]
06/14/2021 04:57 PM <SYMLINK> SOFTWARE_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SOFTWARE]
06/14/2021 04:57 PM <SYMLINK> SYSTEM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SYSTEM]
06/14/2021 04:57 PM <SYMLINK> DEFAULTUSER_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\DEFAULT]
06/14/2021 04:57 PM <SYMLINK> SAM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SAM]
06/14/2021 04:57 PM <SYMLINK> SECURITY_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SECURITY]
06/14/2021 04:57 PM <SYMLINK> SOFTWARE_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SOFTWARE]
06/14/2021 04:57 PM <SYMLINK> SYSTEM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SYSTEM]
05/22/2021 09:02 AM <SYMLINKD> All Users [C:\ProgramData]
06/14/2021 04:57 PM <SYMLINK> DEFAULTUSER_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\DEFAULT]
06/14/2021 04:57 PM <SYMLINK> SAM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SAM]
06/14/2021 04:57 PM <SYMLINK> SECURITY_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SECURITY]
06/14/2021 04:57 PM <SYMLINK> SOFTWARE_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SOFTWARE]
06/14/2021 04:57 PM <SYMLINK> SYSTEM_BASE [C:\ProgramData\Microsoft\Windows\Containers\BaseImages\40caa4df-ced5-4c45-99a3-7e2bc561dafb\BaseLayer\Files\Windows\System32\Config\SYSTEM]
02/26/2021 03:15 AM <SYMLINKD> Downloads [E:\Downloads\]
22:01:38.69$ rem/
接受 PS7 答案并在一秒钟内给出不同的结果:https://superuser.com/a/1652788/68111
答案1
$_.Linktype 未找到符号链接。$_.Attributes 未找到硬链接。连接点在两个属性中列出。需要 -Force,否则将跳过隐藏的符号链接。获取符号链接、连接点和硬链接的完整工作示例:
Get-ChildItem -Path "C:\Windows\","c:\","$env:USERPROFILE" -Force |
Where-Object { $_.LinkType -ne $null -or $_.Attributes -match "ReparsePoint" } |
ft FullName,Length,Attributes,Linktype,Target
输出结果如下 - 在我的情况下,我创建了一个连接点,只是为了展示它应该是什么样子。请注意:PS 仍然有一个错误,无法显示符号链接的目标,请查看此处了解更多信息:https://stackoverflow.com/questions/16926127/powershell-to-resolve-junction-target-path
PS D:\> Get-ChildItem -Path "C:\Windows\","c:\","$env:USERPROFILE" -Force |
Where-Object { $_.LinkType -ne $null -or $_.Attributes -match "ReparsePoint" } |
ft FullName,Length,Attributes,Linktype,Target
FullName Length Attributes LinkType Target
-------- ------ ---------- -------- ------
C:\Windows\bfsvc.exe 79360 Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.17763.1518_no...
C:\Windows\DfsrAdmin.exe 232960 Archive HardLink {C:\Windows\WinSxS\msil_dfsradmin_31bf3856ad364e35_10.0.17763.529_none_86a482ce47ce0e6b\DfsrAdmin.exe...
C:\Windows\explorer.exe 4389168 Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.17763.1911_none_9f01b4994bb...
C:\Windows\HelpPane.exe 1072128 Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.17763.1911_none_b9659da9...
C:\Windows\hh.exe 18432 Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.17763.1697_none_15caed9d569...
C:\Windows\mib.bin 43131 Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-snmp-mgmt-api_31bf3856ad364e35_10.0.17763.1_none_dc5249570...
C:\Windows\notepad.exe 254464 Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.17763.1697_none_bc8f846641e0...
C:\Windows\regedit.exe 357888 Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.17763.1697_none_41a3...
C:\Windows\splwow64.exe 133632 Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.17763.1697_non...
C:\Windows\twain_32.dll 64512 Archive HardLink {C:\Windows\WinSxS\wow64_microsoft-windows-w..ion-twaincomponents_31bf3856ad364e35_10.0.17763.1_none_...
C:\Windows\WindowsShell.Manifest 670 ReadOnly, Hidden, Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-shell32_31bf3856ad364e35_10.0.17763.1_none_5cef14c36a2559b...
C:\Windows\winhlp32.exe 11776 Archive HardLink {C:\Windows\WinSxS\wow64_microsoft-windows-winhstb_31bf3856ad364e35_10.0.17763.1_none_2420a29095f0ffc...
C:\Windows\WMSysPr9.prx 316640 Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-wmvsdk_31bf3856ad364e35_10.0.17763.1_none_96f1...
C:\Windows\write.exe 11264 Archive HardLink {C:\Windows\WinSxS\amd64_microsoft-windows-write_31bf3856ad364e35_10.0.17763.1_none_5048bc153541494b\...
C:\BackupPlatte Directory, ReparsePoint Junction {Volume{6072e7bc-2cae-11e9-b57a-bc5ff4e5c991}\}
C:\Dokumente und Einstellungen Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Programme Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Administrator\Anwendungsdaten Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Administrator\Cookies Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Administrator\Druckumgebung Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Administrator\Eigene Dateien Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Administrator\Lokale Einstellungen Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Administrator\Netzwerkumgebung Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Administrator\Recent Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Administrator\SendTo Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Administrator\Startmenü Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Administrator\Vorlagen Hidden, System, Directory, ReparsePoint, NotContentIndexed
简单的修改可以深入了解我在搜索 ( -and $_.Length -eq 1
)时的情况仅限 Powershell 7 +:
PS > Get-ChildItem -Path "C:\Windows\","c:\","$env:USERPROFILE" -Force |
Where-Object { $_.LinkType -ne $null -or $_.Attributes -match "ReparsePoint" -and $_.Length -eq 1 } |
ft FullName,Attributes,Linktype,Target
FullName Attributes LinkType Target
-------- ---------- -------- ------
C:\Documents and Settings Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Application Data Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Cookies Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Downloads Directory, ReparsePoint SymbolicLink {E:\Downloads\}
C:\Users\Louis\iCloudDrive ReadOnly, Directory, Archive, ReparsePoint {}
C:\Users\Louis\Local Settings Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\My Documents Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\NetHood Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\PrintHood Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Recent Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\SendTo Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Start Menu Hidden, System, Directory, ReparsePoint, NotContentIndexed
C:\Users\Louis\Templates Hidden, System, Directory, ReparsePoint, NotContentIndexed
答案2
尝试以下命令:
dir /AL /S C:\
/A
显示具有特定属性的所有文件,并L
指定重新解析点(符号链接和目录连接)/S
使命令递归- 替换
C:\
为要扫描的驱动器号,如果不想扫描整个驱动器,则替换为路径
答案3
在 PowerShell 中
Get-ChildItem -Path C:\ -Force -Recurse -ErrorAction 'silentlycontinue' |
Where { $_.Attributes -match "ReparsePoint"}
-Force
包括隐藏文件和系统文件-Recurse
获取所有子项-ErrorAction 'silentlycontinue'
抑制拒绝访问路径 XYZ错误Where { $_.Attributes -match "ReparsePoint"}
检查文件夹和文件是否交界处
解释模式和属性†:
PS > Get-ChildItem | SELECT Mode,Attributes -Unique
Mode Attributes
---- ----------
d---- Directory
d---s System, Directory
d---- Directory, NotContentIndexed
d---- Directory, Compressed
la--- Archive
-a--- Archive
lar-- ReadOnly, Archive
-a--- Archive, Compressed
答案4
我知道这个答案已经晚了,但下面这个答案可能更接近你想要的:
dir /AL /S C:\ | find "SYMLINK"