inetpub Folder Security in Windows 10/11: Risks & Protective Measures After April 2025 Update

The inetpub folder, a long-standing directory associated with Microsoft's Internet Information Services (IIS), has recently become a focus of security attention in Windows 10 and Windows 11 systems following the April 2025 cumulative updates. This seemingly innocuous, often empty folder, now automatically created on all updated systems, serves as a critical component of a security patch but also introduces a surprising exploit vector due to the way Windows handles it. This article unpacks the background, the security implications of the inetpub folder's creation, how it can be exploited, and the preventive measures necessary for users and administrators.

Origins and Purpose of the inetpub Folder in Modern Windows Updates​

Traditionally, the inetpub folder hosts web server files for IIS, including website content, logs, and scripts. It is generally present only on systems where IIS is installed, mostly developer and server machines. However, the April 2025 Windows 11 update (notably KB5055523 and related patches) introduced the inetpub folder universally on consumer and enterprise devices alike.
This addition was not a mere housekeeping glitch but a deliberate security measure by Microsoft to address a serious vulnerability identified as CVE-2025-21204. This flaw stems from improper symbolic link (symlink) handling within the Windows Update servicing stack. Essentially, symbolic links can redirect file operations, and if handled incorrectly, can allow attackers to manipulate critical system file operations or escalate privileges.
By creating a secured, controlled folder—inetpub—Microsoft aimed to thwart exploits that leverage missing directories or symlink manipulations to hijack Windows Update processes. The folder acts as a container, a trusted domain with restricted permissions, designed to prevent unauthorized symbolic link abuse and ensure the integrity of the update mechanism.
Microsoft explicitly warns users and administrators not to delete this folder even if they do not run IIS. Removing it disables the newly added security safeguard and reopens attack surfaces the update intended to close. In cases where the folder has been deleted, Microsoft advises restoring it by enabling IIS through the Windows Features dialog, which recreates inetpub with the necessary security configurations, or by reinstalling the update , .

How the inetpub Folder Can Be Exploited​

While the creation of inetpub was a security fix, it inadvertently introduced a new vulnerability exploitable by any local user with even non-administrative privileges. Security researcher Kevin Beaumont exposed this loophole: a local user can replace the inetpub folder with a directory junction (a type of symlink) redirecting the update servicing stack to a location it should not access.
For example, a non-admin user can execute the command:
mklink /J C:\inetpub C:\Windows\System32\notepad.exe
This changes the inetpub folder to a junction pointing to notepad.exe. When the Windows Servicing Stack, which runs as SYSTEM and trusts the inetpub folder, attempts to stage update files into inetpub, it instead resolves the junction to the executable file. Since the servicing stack treats inetpub as a privileged location, it does not verify whether the folder is a normal directory or a junction. This misdirection causes the Windows Update process to fail, roll back, or malfunction, effectively sabotaging system patching.
This vulnerability is particularly dangerous because it requires no admin privileges and can be triggered with a simple command known in public documentation. Attackers or malicious insiders with basic access could disrupt updates or cause security dereliction on affected machines. Furthermore, error messages generated by this failure are non-specific and can lead to frustrating troubleshooting, delaying patch application.
To clarify:

• The Windows Servicing Stack runs with SYSTEM privileges.
• It assumes inetpub is a safe, normal folder.
• It does not check for directory reparse points (junctions).
• A directory junction can redirect operations to an arbitrary file/folder.
• This redirection breaks update staging, causing failures and rollback.

The exploit is essentially a low-barrier misdirection attack exploiting trust assumptions in critical update paths, .

The Temporary Fix: Permission Hardening on the inetpub Folder​

Microsoft has yet to formally address this specific exploit publicly or provide a patch that mitigates the symlink redirection problem in the Windows Servicing Stack. Until such a fix arrives, users and IT administrators are advised to harden permissions on the inetpub folder to prevent non-system processes, including regular users and even admins, from changing or deleting it.
The key workaround is to restrict write and delete permissions on C:\inetpub exclusively to SYSTEM and the TrustedInstaller service. This prevents users from creating malicious junctions, as creating a directory junction requires deleting or modifying the existing folder, which would be blocked by the restricted permissions.
The steps to implement this are:

• Right-click the inetpub folder and select Properties.
• Navigate to the Security tab and click Advanced.
• Click "Disable inheritance" and remove all inherited permissions.
• Add SYSTEM with Full Control permissions.
• Add NT SERVICE\TrustedInstaller with Full Control permissions.
• Remove all other user or group permissions.

With these permissions in place, even admin-level users cannot modify or delete the inetpub folder, preventing the creation of directory junctions that could hijack Windows Update operations. Importantly, these restricted permissions do not affect Windows Update functionality, as SYSTEM and TrustedInstaller retain full control.
If needed, these changes can be reverted by re-enabling inheritance and restoring default permissions.
This manual security configuration acts as a firewall against this low-privilege attack vector until Microsoft develops a more comprehensive servicing stack update.

Implications and Broader Context​

The inetpub folder vulnerability and its patch reveal several insights into modern Windows security paradigms:

• Complexity of Modern Security: Microsoft’s security mechanisms increasingly rely on structural system changes, such as dedicated folders with strict permissions, to mitigate attacks exploiting symbolic links and filesystem manipulations—a layer beyond traditional code patches.
• Patch Side Effects: Attempting to fix one security flaw can inadvertently introduce another if underlying assumptions, such as trust in folder types or ownership, are not rigorously enforced.
• Local Attack Risk: While this exploit requires local access, the prevalence of shared workstations, remote desktop sessions, and multi-user scenarios elevates its risk. Non-admin users gaining foothold on a compromised device could sabotage critical updates.
• Manual Mitigation Burden: The responsibility of mitigating this issue partially shifts to power users and IT admins, needing to apply permission tweaks and educate users, illustrating ongoing challenges in balancing seamless update deployment with security robustness.
• Communication Transparency: Microsoft's initial silence post-disclosure and the general lack of official guidance underscore a recurring theme in large OS vendors' handling of sensitive security flaws—delayed or opaque communication can increase exposure risks and community frustration.
• System Hygiene vs. Security: Users tempted to "clean up" empty or unknown folders risk destabilizing crucial internal security mechanisms. The inetpub folder is a prime example; what appears as redundant system clutter is a sentinel guarding update integrity.

Recommendations for Users and Administrators​

• Do Not Delete inetpub: Regardless of IIS usage, keep this folder intact, as its removal disables critical security protections related to patch servicing.
• Apply Permission Restrictions: Harden C:\inetpub permissions to SYSTEM and TrustedInstaller full control only, removing user and admin rights to prevent malicious symlink creation.
• Monitor Updates and Security Advisories: Stay informed of Microsoft updates addressing this issue and security bulletins detailing servicing stack patches or mitigation strategies.
• Educate Users: In enterprise environments, communicate the purpose of the inetpub folder and the risks of unauthorized modification to reduce accidental deletion or tampering.
• Restore inetpub if Deleted: If removed inadvertently, recreate by enabling IIS temporarily through Control Panel or reinstall the latest security updates.
• Troubleshoot Windows Update Properly: If update failures occur, consider resetting Windows Update components and permissions related to inetpub as part of remediation.

Final Thoughts​

The inetpub folder saga emphasizes the complexity of Windows security in the modern era. An empty directory with an obscure name quietly stands as a bastion against privilege escalation attacks through symbolic link exploits. Yet, its exploitable trust assumptions and the need for manual permission intervention reveal challenges that Microsoft and security professionals still grapple with.
For users, the lesson is clear: respect Windows system folders, especially those introduced by security patches, because they often play unseen but vital roles in your system’s defense. For Microsoft, this incident highlights the need for deeper servicing stack hardening and more transparent communication to avoid turning protective mechanisms into attack vectors.
As Windows continues to evolve, so too will the strategies for patching security flaws—balancing usability, automation, and airtight protection will remain the ongoing challenge.

---

References:

• Security researcher Kevin Beaumont’s disclosure of the inetpub junction exploit and workaround
• Microsoft updates KB5055523 and related cumulative patches for Windows 10/11, April 2025
• CVE-2025-21204 vulnerability details and symbolic link exploitation context
• Community discussions and official guidance on preventing inetpub folder manipulation
• Step-by-step permission adjustment procedures for inetpub hardening

Detailed discussion on these can be found in WindowsForum.com community threads and related technical write-ups .

---

Source: Windows 11's New Inetpub Folder is Hackable. Try This Temporary Fix - Make Tech Easier