Windows shortcut Properties can reveal what a .lnk file is designed to open. Checking the target and arguments is useful when a shortcut is broken, appeared unexpectedly, or came from a removable drive. Inspection is not the same as execution: do not double-click a suspicious shortcut to “see what happens.”
What to record before you inspect it
- The full file name and location.
- When it appeared and whether similar shortcuts appeared nearby.
- Whether it came from a USB drive, email attachment, download, or software installer.
- Whether the original folder or application is still present.
If the shortcut may be evidence, copy it using an approved incident-response procedure and calculate a hash before changing or deleting it.
View the target with Windows Properties
- In File Explorer, enable View > Show > File name extensions.
- Right-click the
.lnkfile and choose Properties. - Open the Shortcut tab.
- Review Target, Start in, Shortcut key, and Run.
- Choose Cancel when you are only inspecting; do not approve unexpected changes.
How to interpret the fields
| Field | What it means | Question to ask |
|---|---|---|
| Target | The program, document, folder, or command interpreter to open | Does it match the shortcut’s name and icon? |
| Arguments | Extra instructions passed to the target | Are they expected and documented? |
| Start in | The working directory used by the target | Is it a legitimate application folder? |
| Icon | The image shown by Explorer | Is the icon being used to imitate a folder or document? |
Examples that need different responses
A shortcut to a familiar application path that no longer exists is probably broken. Repair it or remove the pointer after confirming the application was intentionally uninstalled.
A shortcut named after a USB folder that launches cmd.exe, PowerShell, a script host, or an unknown executable needs security review. Those tools have legitimate uses, but a mismatch between the visible folder name and the actual command is a strong reason not to open it.
Inspect many shortcuts with Shortcut Remover
Shortcut Remover can enumerate shortcut files and display targets, arguments, validity, and risk reasons in one review workflow. Select a narrow folder when possible, check coverage counts, and use filtering to focus on unexpected targets. Prefer quarantine when you may need to restore an item.
Download Shortcut Remover Read the complete .LNK safety guide
What Properties cannot prove
Properties can show intent, but it cannot guarantee that the referenced file is safe. The target may have changed since the shortcut was created, a payload may be missing, or a command may be difficult to interpret. Scan the containing drive and referenced file with a maintained security product.
Frequently asked questions
Is right-clicking a shortcut safe?
Opening the Properties dialog is substantially safer than launching the shortcut, but no inspection step replaces endpoint protection or an isolated analysis environment for a serious incident.
Why is the Target field unavailable?
The item may not be a normal file-system shortcut, it may be damaged, or Windows may be showing properties for a different shell object. Confirm the file type and location.
Can I edit the Target field?
Yes, but change it only when you know the correct target and required arguments. Recreating the shortcut from a trusted target is often clearer.
Related: repair broken shortcuts and distinguish a broken shortcut from shortcut-virus behavior.