Cross-user data redirection via folder junction

Folder Redirection in Microsoft Windows allows local users to redirect another user's personal data through a folder junction. A low-privilege user creates a target folder beneath the redirection root and places a junction where a new user's folder will be created, causing logon-time redirection to copy that user's files into the attacker-controlled location. Exploitation requires Group Policy Folder Redirection and a file server co-located with the Terminal Server.