Windows rejected the organization shortcut: ${shortcutPath}

Error message

Windows rejected the organization shortcut: ${shortcutPath}

What it means

registerWindowsBrandShortcut() creates the organization-branded .lnk shortcut via writeWindowsBrandShortcut(), which wraps Electron's shell.writeShortcutLink. If the COM/IShellLink operation fails (returns falsy), the code throws this error naming the intended final shortcut path. The shortcut is first written to a temp path, then renamed into place.

Source

Thrown at apps/desktop/electron/main.mjs:512

}

async function registerWindowsBrandShortcut(appId, appIconPath) {
  if (process.platform !== "win32") return null;
  const shortcutPath = windowsBrandShortcutPath();
  const shortcutTempPath = `${shortcutPath}.${process.pid}.tmp.lnk`;
  await mkdir(path.dirname(shortcutPath), { recursive: true });
  // Recreate instead of replacing in place. Explorer can retain the old
  // target and search metadata when a prior installer owned this path.
  await rm(shortcutPath, { force: true });
  await rm(shortcutTempPath, { force: true });
  const details = windowsBrandShortcutDetails({
    target: windowsExecutablePath(),
    appId,
    appIconPath,
    appName: currentDisplayAppName,
  });
  const written = writeWindowsBrandShortcut(shell, shortcutTempPath, details, false);
  if (!written) throw new Error(`Windows rejected the organization shortcut: ${shortcutPath}`);
  await rename(shortcutTempPath, shortcutPath);
  if (shell.readShortcutLink(shortcutPath).target !== details.target) {
    repairWindowsShortcutTarget(shortcutPath, details);
  }
  const previousShortcutPath = await readWindowsBrandShortcutMarker();
  if (previousShortcutPath && previousShortcutPath !== shortcutPath) {
    await rm(previousShortcutPath, { force: true });
  }
  if (windowsInstalledShortcutPath() !== shortcutPath) {
    await rm(windowsInstalledShortcutPath(), { force: true });
  }
  await writeFile(windowsBrandShortcutMarkerPath(), shortcutPath, "utf8");
  return shortcutPath;
}

async function removeWindowsBrandShortcut() {
  if (process.platform !== "win32") return;
  const shortcutPath = await readWindowsBrandShortcutMarker();

View on GitHub (pinned to 2b7df46e8a)

Solutions

Verify windowsExecutablePath() points to an existing .exe before creating the shortcut.
Ensure the destination directory (shortcutPath's folder) exists and the process has write permission.
Check Group Policy / antivirus rules that block .lnk file creation and whitelist the app.
Log the shell.writeShortcutLink failure detail inside writeWindowsBrandShortcut to surface the real COM error.

Example fix

// before
if (!written) throw new Error(`Windows rejected the organization shortcut: ${shortcutPath}`);
// after
if (!written) {
  if (!fs.existsSync(details.target)) throw new Error(`Shortcut target missing: ${details.target}`);
  throw new Error(`Windows rejected the organization shortcut: ${shortcutPath}`);
}

Defensive patterns

Strategy: try-catch

Validate before calling

import { existsSync, accessSync, constants } from 'node:fs';
if (!existsSync(windowsExecutablePath())) throw new Error('shortcut target missing');
accessSync(path.dirname(shortcutPath), constants.W_OK);

Try / catch

try {
  await registerWindowsBrandShortcut();
} catch (err) {
  if (String(err.message).startsWith('Windows rejected the organization shortcut')) {
    console.error('Shortcut creation blocked — check target path, write perms, and GPO policy.', err.message);
  } else throw err;
}

Prevention

Confirm the target .exe exists before writing the .lnk.
Ensure the destination folder exists and is writable by the process.
Whitelist the app in enterprise policy/AV that blocks .lnk creation.
Log the shell.writeShortcutLink return value/failure reason for diagnostics.

When it happens

Trigger: Calling registerWindowsBrandShortcut() when writeWindowsBrandShortcut() returns false — Windows COM refuses to write the .lnk (invalid target/icon path, path on non-writable volume, shell COM initialization failure, or policy blocking shortcut creation).

Common situations: Enterprise GPO restrictions on .lnk creation; target executable path missing or containing characters IShellLink rejects; writing to ProgramData or a network drive without write permission; app running with insufficient privileges.

Related errors

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/b6382897dc582243. Report an issue: GitHub.