How can I create symbolic links in Windows 8.1 without an admin command prompt?
Privilege missing in "filtered" token
Either disable UAC. Or with UAC enabled: after enabling SECreateSymbolicLinkPrivilege
try with a non-admin account.
Explanation
It's catch 17. From how I read the MS-documentation.
If you have a blacklisted well-known admin-group in your user-account, then a second, non-elevated, token is created.
The relevant SeCreateSymbolicLinkPrivilege
is filtered out when the non-elevated token is generated from the elevated token.
From MSDN: User Interface Privilege Isolation (UIPI):
Windows will create two access tokens for the user if either of the following is true: The user's account contains any of the following RIDs.
DOMAIN_GROUP_RID_ADMINS
[...]
What privileges the filtered token contain are based on whether the original token contained any of the restricted RIDS listed above. If any of the restricted RIDs were in the token, all of the privileges are removed except:
SeChangeNotifyPrivilege
SeShutdownPrivilege
SeUndockPrivilege
SeReserveProcessorPrivilege
SeTimeZonePrivilege
So the solution is to disable the second token generation altogether. Either by removing all the mentioned groups from your account, or by completely disabling UAC.
(Disclaimer: Paul Betts did the work. I just added some detail. See his answer here: https://stackoverflow.com/questions/15320550/secreatesymboliclinkprivilege-ignored-on-windows-8 )