Windows April 2025 Patch Creates Mysterious inetpub Folder: What You Need to Know

When Windows users installed the latest Patch Tuesday update for April 2025, an unexpected and rather bewildering mystery greeted them on their primary drive: a new, empty folder named “inetpub.” While its presence was innocuous at first glance—empty, zero bytes, and seemingly without function—it set off alarm bells for vigilant users who rapidly moved to delete it, suspecting malware, bloatware, or an installation fluke. However, this seemingly harmless act of folder deletion may have inadvertently exposed millions of PCs to risk, as further investigation and clarifications from Microsoft revealed. Today, we untangle the story behind the mysterious inetpub folder, examine its true purpose, the vulnerabilities it relates to, and what you must do if you’ve already deleted it.

The Peculiar Case of the “inetpub” Folder​

Windows’ Patch Tuesday—traditionally the second Tuesday of each month—has a reputation among power users: it delivers security patches but also, on occasion, introduces bugs, quirks, and even mysterious files or folders. Yet, an empty directory like “inetpub,” appearing without explanation, was enough to make even veteran Windows enthusiasts raise an eyebrow.
Historically, the inetpub folder is associated with IIS (Internet Information Services), Microsoft’s web server component. Normally, it appears only when IIS is enabled—usually on servers, developers' machines, or those hosting local web content. This is not standard fare for the average home user; so, why did millions see it pop up after April’s security update, regardless of whether IIS was even enabled?

Initial User Reactions: Deletion and Unanswered Questions​

Understandably, users who noticed the folder—sitting on the C: drive alongside core system folders like Windows and Program Files—assumed it was a mistake or even a remnant of a failed install. Security-conscious users, wary of anything anomalous, deleted the folder.
Microsoft’s original response was rather minimal: the folder is “nothing to worry about.” Yet, independent security researchers, including respected analyst Kevin Beaumont, flagged a cause for concern. Beaumont warned that without inetpub, non-administrator users might be able to interfere with Windows Update’s security patching mechanism—potentially blocking future updates from being applied.
This chilling prospect forced Microsoft to update its public-facing documentation and quietly clarify: while the folder itself appears empty, it is integral to a behind-the-scenes security fix for a major vulnerability: CVE-2025-21204.

CVE-2025-21204: A Silent But Serious Threat​

Let’s dig deeper into CVE-2025-21204, the vulnerability at the center of this saga. According to Microsoft’s official security advisory, the flaw involves improper link resolution during Windows Updates. In plainer terms, Windows Update could be tricked—via symbolic links (symlinks)—into following a path that allows a local attacker to read from or write to locations they should not have access to.
Without properly locking down certain folders, a low-privilege user could technically redirect Windows Update, subverting its checks and potentially gaining elevated privileges or sabotaging the update process itself. The result could be catastrophic: blocked security updates, hijacked files, or even compromised system integrity.
The creation of the inetpub folder—protected with specific Access Control Lists (ACLs)—prevents attackers from exploiting this symlink trick by ensuring Windows Update cannot be fooled into tampering with (or being tampered from) that location.

Microsoft’s Quiet Fix—And Why Deleting the Folder is Risky​

Rather than publicize a complex technical explanation at the onset, Microsoft simply stated that the presence of inetpub is part of the required fix, and users should not delete it. Only as the days progressed and security researchers pressed for more information did the true risk come to light. Devices missing inetpub—notably, due to manual deletion—are left exposed, meaning the CVE-2025-21204 vulnerability is not properly mitigated.
This means that by deleting the “empty” folder, cautious users may have inadvertently disabled their own protection against a real attack vector. The danger is not theoretical: malicious actors could exploit unpatched systems, especially in multi-user environments, schools, businesses, or shared PCs, where non-admin users have local access but not full administrative rights.

Microsoft’s Directive: Bring the Folder Back—Now​

As reports circulated and unease grew, Microsoft updated its guidance. The message was clear: if you’ve deleted inetpub, you must restore it as soon as possible. The fix is not to wait for another cumulative update, but rather to actively recreate the folder—making sure it has the correct security settings.
So, how can you safely restore inetpub, ensuring full protection from CVE-2025-21204, without accidentally installing or enabling unwanted features?

Option 1: Enable Internet Information Services (IIS)​

One straightforward—if somewhat heavy-handed—option is to turn Internet Information Services on from the “Windows Features” panel. This will definitely bring back inetpub, but as any experienced user knows, it also installs additional folders, services, and components that most people won’t ever use. For power users or admins who don’t plan to host local websites, this is overkill and adds unnecessary complexity, potential performance impact, and more attack surface.

Option 2: The Microsoft PowerShell Script​

Responding to user frustration, Microsoft and community experts suggested a cleaner solution: a PowerShell script that creates inetpub with the proper permissions—no need to install IIS or bloat your system.
The process, as confirmed by Microsoft and corroborated by trusted outlets like Windows Latest and XDA Developers, is as follows:

Step 1: Allow the Execution of Signed Scripts​

Open PowerShell as Administrator and run:
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
This step is crucial to allow the download and execution of scripts necessary to restore einaetpub securely.

Step 2: Download and Install the Script​

Next, run:
Install-Script -Name Set-InetpubFolderAcl -Force
If prompted to install the NuGet Provider, type Y to proceed.

Step 3: Apply the Fix​

Execute:
Set-InetpubFolderAcl
If this command isn’t found, try the direct path:
& "C:\Program Files\WindowsPowerShell\Scripts\Set-InetpubFolderAcl.ps1"
This sequence will create the needed folder, fill in the correct ACLs (permissions), and bring your system back into compliance with Microsoft’s security patch expectations.

Critical Analysis: Strengths, Flaws, and Implications​

Notable Strengths​

• Transparent Mitigation of a Real Security Threat: The use of ACLs and an easily verifiable fix (the presence of a single folder) provides robust evidence that Microsoft is taking patching seriously. The swift creation of a script and publication of clear remediation steps, albeit belated, showcases responsiveness to evolving risks and user confusion.
• Avoidance of Feature Creep: By offering a focused PowerShell-based restoration, users are not burdened with extra, unneeded features (like the rest of IIS), keeping their systems lean and less vulnerable to future, unrelated exploits.
• Community Involvement: The rapid investigation and reporting by outlets such as XDA Developers and Windows Latest, along with input from independent experts like Kevin Beaumont, demonstrates the strength of collective vigilance. Community voices pressured Microsoft to clarify and provide better tools.

Risks, Weaknesses, and Areas of Concern​

• Lack of Initial Communication: Microsoft’s initial silence, downplaying the folder’s appearance, and vagueness regarding its security implications fostered confusion. Many users—especially those with security expertise—are trained to treat sudden, unexplained file system changes with deep suspicion. Had Microsoft proactively explained the situation, mass deletions could have been avoided.
• Unintentional User Risk: By pushing a fix that hinges on an unexpected, unexplained folder (appearing, no less, on every Windows 11 PC), Microsoft inadvertently encouraged its removal by cautious users. This action paradoxically exposed these very users to the vulnerability the patch intended to fix, especially since the folder appeared even when IIS was not enabled, breaking expected behavior.
• Remediation Is Not Automatic: There’s no automated “healing” mechanism if the folder is deleted post-update. Users must take manual action—either installing IIS (adding complexity) or running PowerShell commands (potentially daunting for less technical users). While the script solution is elegant for power users, average consumers may be unaware or uncomfortable with command-line remediation.
• Potential New Attack Surface: While there is no evidence so far that the scripted approach introduces new vulnerabilities, the use of system scripts to manage ACLs highlights a recurring security trade-off: every extra moving part requires ongoing scrutiny. If malicious actors masquerade their own scripts as legitimate fixes, inexperienced users could introduce risk unknowingly.
• Undocumented Side Effects: The PowerShell script option appears straightforward—but relies on the accuracy and authenticity of the provided resources. There’s little visibility for users into what exactly the script is doing unless they inspect it closely, underscoring the importance of only trusting official sources.

How Should Users Respond? Best Practices for 2025​

The “inetpub” incident is a microcosm of a larger reality facing all Windows users: modern systems are ever more complex, and security patches—while vital—can introduce edge cases that, if not managed carefully, may confuse or even compromise the very users they’re designed to protect.
Here’s what every Windows user, enthusiast, and administrator should take away:

1. Trust but Verify​

If you notice unexplained changes after an update, resist the impulse to delete or modify them—at least until you’ve confirmed their legitimacy with current documentation. Major Windows update days always spark confusion on forums and tech news sites; use these resources to cross-check any peculiar changes.

2. Lean on the Community and News Outlets​

The coverage by XDA Developers, Windows Latest, and independent infosec personalities was instrumental in surfacing the truth behind the inetpub folder. Subscribing to trusted news feeds and following reputable researchers can save you time, stress, and protect your machines from unintended consequences.

3. Use Microsoft’s Official Fixes​

Whenever possible, avoid taking drastic manual action unless Microsoft or a reliable channel provides step-by-step remediation. Scripts published via the PowerShell Gallery (such as “Set-InetpubFolderAcl”) are generally vetted; running unknown code from forums, however, is risky.

4. Check Folder and System Permissions​

Security through ACLs is core to patching modern vulnerabilities. If you manage multiple machines or share devices, confirm after each Patch Tuesday that key folders (including inetpub) exist with the expected permissions.

5. Fearless, Cautious Upgrading​

While defaulting to paranoia can keep your system safe from malware, it can also backfire in cases like this. Instead, approach system anomalies methodically: isolate the machine if concerned, research community reactions, consult Microsoft’s advisories, and act accordingly.

Conclusion: Lessons From an Unwanted Folder​

The case of the mysterious “inetpub” folder in Windows 11 is more than a quirk of one Patch Tuesday. It is a vivid reminder that modern OS security is not just about installing updates—it’s about understanding their ramifications, communicating clearly, and equipping users with both knowledge and tools to respond properly.
Microsoft’s eventual clarity about the folder’s necessity, its connection to a real-world exploit (CVE-2025-21204), and the provision of a script-only fix represent a positive arc. Yet, the story began with obtuse communication, leading security-minded users to accidentally undermine their own defenses.
As Windows continues to evolve, every Patch Tuesday will bring not just fixes, but also the potential for side effects. The best defense, ironically, is often not reactive deletion—but rather proactive information gathering, context, and trusted sources. If you deleted the inetpub folder after April’s update, your system may still be at risk—but, with the steps above, you can restore your defenses in minutes. Watch for new folders. Ask why they’re there. And always double-check before you delete.
In the ever-shifting landscape of Windows security, vigilance, patience, and a healthy dose of skepticism remain your most important tools—followed closely by timely, accurate information.

---

Source: XDA Your Windows PC might be at risk if you deleted the "inetpub" folder, but there’s a fix