Symbolic Links (MKLINK) creation failed with Intune Win32 apps and SYSTEM account #1298
-
|
I have created an Intune Win32 app using PSADT v4.05 and Invoke-ServiceUI.ps1. The app package installs and runs without any issues; however, it fails to create a symbolic link to redirect application logs to It's important to note that creating symbolic links under the SYSTEM account is not permitted.
I have tried adding both the SYSTEM and EVERYONE accounts to the "Create symbolic links" permissions, but the error persists.
I'm running out of ideas. Do you have any suggestions? It would be great to have all the logs I need in one location!eed under one location! |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments 6 replies
-
|
You can just set the logging path in the config? By the way, that obscure parameter set error message is a slight regression and is already resolved for the next patch release. |
Beta Was this translation helpful? Give feedback.
-
|
I have to use a symbolic link since the Dell Command Update log does not allow it to be moved under %ProgramData%. |
Beta Was this translation helpful? Give feedback.
-
|
Yeah no worries... I've had a similar experience with Dell Command | Update, it's very picky on where it logs. You'll probably need to make a temporary local user account to get the job done, then clean that up at the end. |
Beta Was this translation helpful? Give feedback.
-
|
You mean like create an account with admin rights and then run the mklink command under this new account ? |
Beta Was this translation helpful? Give feedback.
-
|
Yeah, possibly performing the entire DCU operation uber the account also. You might also find that the issue here is that it's not so much SYSTEM that can't create the symlink, it's that ServiceUI won't let you as it has limitations. |
Beta Was this translation helpful? Give feedback.
-
|
Good find, well I can live without it for now, especially if there's a fix coming. Thanks for sharing your insights! |
Beta Was this translation helpful? Give feedback.
-
|
It'll be quite a few months before were in a position where you don't need ServiceUI, so just keep that in mind. |
Beta Was this translation helpful? Give feedback.
-
|
No worries, I don't necessarily need to use Invoke-ServiceUI.ps1 for this package anyway since it will be applied during Autopilot so this one can be completely silent. |
Beta Was this translation helpful? Give feedback.
-
|
And the scripts work perfectly fine when running locally with admin rights. |
Beta Was this translation helpful? Give feedback.
-
|
Btw, I have used this script to give permission to EVERYONE to create symbolic links. This module could be used as well. https://www.powershellgallery.com/packages/SecurityPolicy |
Beta Was this translation helpful? Give feedback.
Yeah, possibly performing the entire DCU operation uber the account also.
You might also find that the issue here is that it's not so much SYSTEM that can't create the symlink, it's that ServiceUI won't let you as it has limitations.
#1053