Microsoft’s recent Windows update released in April 2025 has introduced an unexpected and somewhat controversial element to the Windows file system: an empty folder named "inetpub" appearing on many user systems. This update, part of Windows 11 24H2 and Windows 10 cumulative patches (notably KB5055523 and its Windows 10 equivalent KB5055518), has left users and administrators puzzled and concerned. Initially, many questioned whether this folder was the result of a bug, malware, or some unintended leftover from the update process. However, further investigation and confirmation from Microsoft illustrated that this folder is actually a deliberate component of a crucial security mitigation effort.
The “inetpub” folder is historically associated with Microsoft’s Internet Information Services (IIS), which is a web server platform used by developers and IT professionals to host web applications and local websites. Conventionally, this folder appears only when IIS is installed and activated, serving as a storage location for web content and log files.
However, the April 2025 update caused this folder to appear even on Windows machines where IIS is not enabled. This phenomenon immediately raised questions and skepticism among users. Was IIS being silently installed? Was this a potential security risk in itself? Microsoft quickly clarified that this sudden appearance was intentional and tied directly to security patching.
The specific security vulnerability addressed by this update is CVE-2025-21204, an elevation-of-privilege flaw within Windows Process Activation. This vulnerability related to symbolic link handling or "link following" within the Windows Update stack that could be exploited by local attackers, especially with physical device access, to manipulate or redirect system files and directories improperly.
Instead of patching the vulnerable component directly in the code, Microsoft chose a workaround: pre-creating the “inetpub” folder on the system drive (usually C:\inetpub) with strict system-owned permissions. This was meant to block potential symlink attack paths by ensuring that symbolic links could not be exploited to redirect system operations improperly. The folder acts as a sort of "safe container" or hardened base to prevent symlink abuse that was at the core of CVE-2025-21204.
This approach is somewhat unconventional since it does not involve a traditional patch to the vulnerable code but rather introduces a structural safeguard at the filesystem level. However, it aligns with a security-by-design strategy: controlling and minimizing exploit paths by controlling filesystem structures and permissions globally.
By running a simple command:
Beaumont demonstrated that the inetpub folder could be transformed into a directory junction pointing to a system executable—or any arbitrary location. When Windows Update tries to interact with this folder, the redirected path causes Windows Update operations to fail, resulting in errors and rollback of updates. This effectively creates a denial-of-service scenario where Windows updates cannot be applied.
What exacerbates concerns is that this "attack" does not require administrative privileges on many default system configurations. Even standard users can run the mklink /j command, allowing them to block Windows updates without escalating privileges.
This finding has serious implications. It means an attacker with limited rights or a careless user could inadvertently or maliciously prevent critical security updates from installing, potentially exposing the system to other known vulnerabilities.
For regular users, the presence of the inetpub folder might be benign and unnoticed, but it’s clear that deleting or tampering with it could have unintended security consequences. Microsoft advises strongly against deleting this folder because it is an active part of the update’s security infrastructure.
If users have removed the folder, Microsoft recommends restoring it by temporarily enabling IIS through the Windows features dialog, which recreates the folder with the proper permissions. Alternatively, uninstalling and reinstalling the April 2025 update also restores the folder and its protections.
For system administrators and security-conscious users, this calls for increased vigilance to monitor for suspicious directory junctions and maintain the integrity of the inetpub folder to ensure ongoing protection.
More broadly, this case study explains that complex operating systems require increasingly intricate defensive strategies—sometimes leveraging legacy components in new ways. However, with this complexity comes the risk of unexpected consequences, underscoring the perpetual need for comprehensive testing, thoughtful implementation, and open dialogue with the user community.
Microsoft has reportedly been notified about the new vulnerability, and users are awaiting a response or fix. Meanwhile, the best practice is clear: do not delete the inetpub folder, monitor for junction abuse, and keep systems updated via official, verified updates.
This episode is a reminder that in the evolving landscape of Windows security, every folder—even an empty, legacy-named one—can become a critical battleground.
References to community and official technical discussions surrounding this issue can be found in multiple Windows enthusiast and security forums with detailed analysis and practical guidance .
Source: Microsoft mystery folder fix might need a fix of its own
The “inetpub” folder is historically associated with Microsoft’s Internet Information Services (IIS), which is a web server platform used by developers and IT professionals to host web applications and local websites. Conventionally, this folder appears only when IIS is installed and activated, serving as a storage location for web content and log files.However, the April 2025 update caused this folder to appear even on Windows machines where IIS is not enabled. This phenomenon immediately raised questions and skepticism among users. Was IIS being silently installed? Was this a potential security risk in itself? Microsoft quickly clarified that this sudden appearance was intentional and tied directly to security patching.
The specific security vulnerability addressed by this update is CVE-2025-21204, an elevation-of-privilege flaw within Windows Process Activation. This vulnerability related to symbolic link handling or "link following" within the Windows Update stack that could be exploited by local attackers, especially with physical device access, to manipulate or redirect system files and directories improperly.
Instead of patching the vulnerable component directly in the code, Microsoft chose a workaround: pre-creating the “inetpub” folder on the system drive (usually C:\inetpub) with strict system-owned permissions. This was meant to block potential symlink attack paths by ensuring that symbolic links could not be exploited to redirect system operations improperly. The folder acts as a sort of "safe container" or hardened base to prevent symlink abuse that was at the core of CVE-2025-21204.
Why the "inetpub" Folder?
Choosing “inetpub” for this purpose is likely due to its long-standing role within Windows as a web server directory controlled by the system. It provides a convenient location with predefined, secured permissions that Microsoft could leverage. By creating this folder across all systems regardless of IIS activation, Microsoft fortified symbolic link protections even on systems not running web services.This approach is somewhat unconventional since it does not involve a traditional patch to the vulnerable code but rather introduces a structural safeguard at the filesystem level. However, it aligns with a security-by-design strategy: controlling and minimizing exploit paths by controlling filesystem structures and permissions globally.
The Unintended Consequence: Security Researcher’s Exploit
Kevin Beaumont, a reputable security researcher, took a closer look at this fix and uncovered an unexpected side effect. The pre-created “inetpub” folder could itself be hijacked using the Windows mklink utility with the /j parameter, which creates a directory junction (a type of filesystem redirect).By running a simple command:
mklink /j c:\inetpub c:\windows\system32\notepad.exeBeaumont demonstrated that the inetpub folder could be transformed into a directory junction pointing to a system executable—or any arbitrary location. When Windows Update tries to interact with this folder, the redirected path causes Windows Update operations to fail, resulting in errors and rollback of updates. This effectively creates a denial-of-service scenario where Windows updates cannot be applied.
What exacerbates concerns is that this "attack" does not require administrative privileges on many default system configurations. Even standard users can run the mklink /j command, allowing them to block Windows updates without escalating privileges.
This finding has serious implications. It means an attacker with limited rights or a careless user could inadvertently or maliciously prevent critical security updates from installing, potentially exposing the system to other known vulnerabilities.
Impact on System Administrators and Users
Administrators and IT professionals are now tasked with scanning for tampered directory junctions that redirect the “inetpub” folder or similar junctions created maliciously. The necessity to check this new vector adds to the already complex responsibilities of patch management and security maintenance.For regular users, the presence of the inetpub folder might be benign and unnoticed, but it’s clear that deleting or tampering with it could have unintended security consequences. Microsoft advises strongly against deleting this folder because it is an active part of the update’s security infrastructure.
If users have removed the folder, Microsoft recommends restoring it by temporarily enabling IIS through the Windows features dialog, which recreates the folder with the proper permissions. Alternatively, uninstalling and reinstalling the April 2025 update also restores the folder and its protections.
Broader Reflections on the Patch and Update Strategy
This incident exposes several wider issues in modern operating system security update practice:- Complexity of Security Fixes: The fix for CVE-2025-21204 avoids patching vulnerable code directly, instead opting for a filesystem-level mitigation. This creative but unconventional approach underscores the increasing complexity of maintaining system security in expansive software platforms such as Windows.
- Trade-offs Between Usability and Security: The introduction of a new folder, especially one linked to IIS, confuses users and administrators alike. Though well-intentioned as a protective measure, the solution has introduced new risks and operational headaches—highlighting the challenge in balancing robust security with minimal disruption.
- Importance of Testing and Risk Assessment: The mklink /j junction exploit exposed by Beaumont suggests that Microsoft's update testing may have overlooked a fundamental attack scenario or edge case. Such oversights can undermine patch effectiveness and public confidence, emphasizing the need for rigorous and holistic security validation.
- Need For Clear Communication: The initial mystery and suspicion around the inetpub folder illustrate the importance of transparent, timely communication from software vendors about update contents and changes. Ambiguity leads to user confusion, unnecessary file deletions, and potential exposure.
Conclusion: Vigilance Required Amid Unconventional Fixes
The April 2025 Windows 11 update’s inetpub folder symbolizes both innovation and the pitfalls in modern security patching. Microsoft’s strategy to thwart CVE-2025-21204 by pre-creating a secured folder on every system is ingenious in theory but has inadvertently introduced a new kind of vulnerability that can disable Windows Update processes without admin privileges.For system administrators and security-conscious users, this calls for increased vigilance to monitor for suspicious directory junctions and maintain the integrity of the inetpub folder to ensure ongoing protection.
More broadly, this case study explains that complex operating systems require increasingly intricate defensive strategies—sometimes leveraging legacy components in new ways. However, with this complexity comes the risk of unexpected consequences, underscoring the perpetual need for comprehensive testing, thoughtful implementation, and open dialogue with the user community.
Microsoft has reportedly been notified about the new vulnerability, and users are awaiting a response or fix. Meanwhile, the best practice is clear: do not delete the inetpub folder, monitor for junction abuse, and keep systems updated via official, verified updates.
This episode is a reminder that in the evolving landscape of Windows security, every folder—even an empty, legacy-named one—can become a critical battleground.
References to community and official technical discussions surrounding this issue can be found in multiple Windows enthusiast and security forums with detailed analysis and practical guidance .
Source: Microsoft mystery folder fix might need a fix of its own