Block Symlink and Junction creation for a Directory

Solution 1:

Create symbolic links is a user privilege, not a file system permission. As such it cannot be controlled for a particular windows directory as you wish. It can only be permitted or denied at a user/group level. By default it is enabled only for the local Administrators group.[1]

You would want to use the Local Security Authority (LSA) functions to work with SeCreateSymbolicLinkPrivilege privilege.

Microsoft Privileges

A system administrator can use administrative tools, such as User Manager, to add or remove privileges for user and group accounts. Administrators can programmatically use the Local Security Authority (LSA) functions to work with privileges. The LsaAddAccountRights and LsaRemoveAccountRights functions add or remove privileges from an account. The LsaEnumerateAccountRights function enumerates the privileges held by a specified account. The LsaEnumerateAccountsWithUserRight function enumerates the accounts that hold a specified privilege.

Privilege Constants