Reparse Point

File system redirection and path resolution

Reparse points are a Windows file system mechanism for redirecting a path to another location or to a handler that processes the path differently. That redirection is what makes junctions, symlinks, mount points and similar objects behave as if the original path were still present, even when the underlying data or target lives elsewhere.

Because the file system resolves the reparse data during path handling, the object can change how a program enumerates, opens or validates a location. That makes reparse points a core part of Windows storage semantics, not just a convenience feature.

Common uses in Windows storage

Administrators use reparse points to simplify navigation, relocate data, and preserve compatibility when paths or storage layouts change. They can make a directory tree look stable while the actual content resides on another volume, network location or special file system handler.

This is useful for storage abstraction and interoperability, but it also means the visible directory structure may not match the physical or logical destination. In practice, the same name can represent a very different backing resource depending on the reparse data attached to it.

Why reparse points matter to access control

Reparse points can influence how access decisions are reached because the object that is checked is not always the object that is ultimately opened. If software assumes a path is local, fixed or non-recursive, a redirect can alter the effective target and create confusion about ownership, traversal and privilege boundaries.

That is why secure code and administrative tooling need to treat reparse handling as part of path validation, not as an edge case. A safe-looking folder tree can still lead to a different security context, storage backend or location once the file system resolves the redirect.

Traversal, detection and safe handling

Reparse points are also important in security tooling because they can complicate enumeration, backup, scanning and recursive file operations. A process that follows them blindly may leave a directory boundary, miss content, or process the same data more than once if links and redirects are chained.

Well-behaved tools usually distinguish between the reparse object itself and the destination it points to, then decide explicitly whether to follow, skip or inspect the target. That distinction is central to avoiding traversal errors and to understanding what an audit, scan or copy operation actually covered.

Risk and Threat Considerations

Reparse points create a control and trust boundary problem when software or administrators assume a path is fixed but the file system resolves it elsewhere. That can lead to path traversal, unintended access to sensitive locations, backup or scan blind spots, and confusion about what was actually executed or modified.

Failure mechanism: An attacker or misconfigured process introduces a redirect after validation or during recursion, then relies on the file system to resolve the path to a different target than the defender expected.

Impact: The result can be unauthorized file access, missed malware discovery, unexpected writes into protected locations, or incorrect evidence collection during incident response.

Practitioner Guidance

What to watch for: Treat recursive file operations, upload handling, cleanup jobs and security scans as reparse-aware. The important judgement is whether the tool should inspect the link object, follow the target, or reject the redirect altogether.

Practitioner note: For high-trust workflows, prefer explicit policy around when reparse points are allowed and when they must be resolved or blocked, rather than relying on default path handling.

Related resources from NHI Mgmt Group

• NTFS Mount Point Reparse Point
• Why do point-in-time reviews fail for shadow AI?
• Why do point-in-time SaaS security tools leave gaps?
• When should teams prioritize identity fabric over another point solution?