An NTFS junction is a type of directory reparse point in the Windows file system that redirects one folder path to another folder path. It is used to make one location appear under another name or path, while the underlying data remains in a different directory.
What an NTFS junction does
An NTFS junction is a directory-level redirection point in Windows that makes one folder path resolve to another folder path. The visible path changes, but the data stays in the target directory, which is why junctions are useful for compatibility and path relocation.
That behaviour matters because applications, administrators, and scripts may follow the apparent path without realising the underlying files live elsewhere. As a result, junctions can affect access patterns, backup behaviour, migration planning, and any security control that depends on understanding the true filesystem location.
How NTFS junctions work in practice
Junctions are part of NTFS reparse point behaviour. When the file system encounters the junction, it interprets the metadata and redirects the lookup to the destination directory rather than treating the folder as an ordinary container.
This is different from copying data or moving a directory tree in a way that changes every reference. A junction preserves an old or convenient path name while allowing the actual content to remain in a new location, which helps avoid breaking legacy applications and hard-coded paths.
Because the indirection happens at the filesystem layer, the redirection can be transparent to many tools. That transparency is helpful for compatibility, but it also means operators must know when a path is only an alias and not the real storage location.
Why NTFS junctions are useful
Junctions are commonly used for migration, compatibility, and storage reorganisation. They let teams relocate data without forcing every consumer to update its path immediately, which is especially useful in Windows environments with older software or tightly coupled directory references.
They can also simplify file-system design by allowing a standard path to point at a different volume or directory structure. In practice, that can reduce disruption during upgrades, profile moves, application refactoring, or platform consolidation.
When used carefully, a junction is a low-friction compatibility tool. When used carelessly, it can create confusing directory graphs that are harder to reason about during incident response, storage review, and permission analysis.
How to recognise and verify an NTFS junction
The important operational question is not only whether a folder exists, but whether it is a real directory or a redirecting link. Operators should verify the target before making assumptions about ownership, backup scope, or access control.
That verification step is especially important in security work because a junction can cause two different paths to refer to the same underlying data. If you are tracing a suspicious file path, following the reparse point is often necessary to understand where the content actually resides and whether another location is involved.
For practical validation, administrators usually inspect the folder metadata or use filesystem-aware tools that reveal reparse point type and target. A path that looks local and ordinary may still be redirecting elsewhere, so verification should be routine wherever path accuracy matters.
Risk and Threat Considerations
Junctions can create security and operational ambiguity when software, backups, or defenders treat the visible path as the authoritative location. That ambiguity can be abused to hide data movement, confuse scanning, or steer a process into an unexpected directory tree.
Failure mechanism: A junction changes path resolution without changing the apparent folder name, so a control that inspects only the source path may miss the real destination or follow a misleading reference.
Impact: This can lead to incomplete backup coverage, mistaken allowlisting or denylisting, incorrect incident triage, and path-traversal style abuse when attackers leverage trusted folder locations to reach sensitive content.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1036 — Masquerading | Junctions can help make a path appear ordinary while redirecting access underneath. |
| Recommendation — Map deceptive path behaviour to T1036 and inspect redirected directories for hidden execution or access paths. | ||
| NIST SP 800-53 Rev 5 | CM-5 — Access Restrictions for Change | Junctions alter filesystem behaviour and need controlled change management. |
| SI-7 — Software, Firmware, and Information Integrity | Redirecting paths can affect integrity checks, scanning, and trusted content location. | |
| Recommendation — Apply CM-5 to approve and track junction creation so directory redirection is intentional and reviewable. Use SI-7 to validate that integrity and scanning processes follow the real target path, not just the visible folder. | ||
Practitioner Guidance
What to watch for: Treat junctions as a filesystem design choice that needs ownership and documentation, not as a harmless shortcut. Any environment that uses them should keep an inventory of redirected paths, because hidden redirection is where confusion and control failure usually begin.
Governance implication: The key discipline is to distinguish the logical path from the physical storage path in reviews, backups, and investigation workflows. If teams cannot state where the data actually lives, they cannot reliably prove what was protected, changed, or accessed.