Windows April 2025 Update Reveals 'inetpub' Folder and New Security Risks

Microsoft’s recent Windows update released in April 2025 has introduced an unexpected and somewhat controversial element to the Windows file system: an empty folder named "inetpub" appearing on many user systems. This update, part of Windows 11 24H2 and Windows 10 cumulative patches (notably KB5055523 and its Windows 10 equivalent KB5055518), has left users and administrators puzzled and concerned. Initially, many questioned whether this folder was the result of a bug, malware, or some unintended leftover from the update process. However, further investigation and confirmation from Microsoft illustrated that this folder is actually a deliberate component of a crucial security mitigation effort.

The Context Behind the "inetpub" Folder's Appearance​

The “inetpub” folder is historically associated with Microsoft’s Internet Information Services (IIS), which is a web server platform used by developers and IT professionals to host web applications and local websites. Conventionally, this folder appears only when IIS is installed and activated, serving as a storage location for web content and log files.
However, the April 2025 update caused this folder to appear even on Windows machines where IIS is not enabled. This phenomenon immediately raised questions and skepticism among users. Was IIS being silently installed? Was this a potential security risk in itself? Microsoft quickly clarified that this sudden appearance was intentional and tied directly to security patching.
The specific security vulnerability addressed by this update is CVE-2025-21204, an elevation-of-privilege flaw within Windows Process Activation. This vulnerability related to symbolic link handling or "link following" within the Windows Update stack that could be exploited by local attackers, especially with physical device access, to manipulate or redirect system files and directories improperly.
Instead of patching the vulnerable component directly in the code, Microsoft chose a workaround: pre-creating the “inetpub” folder on the system drive (usually C:\inetpub) with strict system-owned permissions. This was meant to block potential symlink attack paths by ensuring that symbolic links could not be exploited to redirect system operations improperly. The folder acts as a sort of "safe container" or hardened base to prevent symlink abuse that was at the core of CVE-2025-21204.

Why the "inetpub" Folder?​

Choosing “inetpub” for this purpose is likely due to its long-standing role within Windows as a web server directory controlled by the system. It provides a convenient location with predefined, secured permissions that Microsoft could leverage. By creating this folder across all systems regardless of IIS activation, Microsoft fortified symbolic link protections even on systems not running web services.
This approach is somewhat unconventional since it does not involve a traditional patch to the vulnerable code but rather introduces a structural safeguard at the filesystem level. However, it aligns with a security-by-design strategy: controlling and minimizing exploit paths by controlling filesystem structures and permissions globally.

The Unintended Consequence: Security Researcher’s Exploit​

Kevin Beaumont, a reputable security researcher, took a closer look at this fix and uncovered an unexpected side effect. The pre-created “inetpub” folder could itself be hijacked using the Windows mklink utility with the /j parameter, which creates a directory junction (a type of filesystem redirect).
By running a simple command:
mklink /j c:\inetpub c:\windows\system32\notepad.exe
Beaumont demonstrated that the inetpub folder could be transformed into a directory junction pointing to a system executable—or any arbitrary location. When Windows Update tries to interact with this folder, the redirected path causes Windows Update operations to fail, resulting in errors and rollback of updates. This effectively creates a denial-of-service scenario where Windows updates cannot be applied.
What exacerbates concerns is that this "attack" does not require administrative privileges on many default system configurations. Even standard users can run the mklink /j command, allowing them to block Windows updates without escalating privileges.
This finding has serious implications. It means an attacker with limited rights or a careless user could inadvertently or maliciously prevent critical security updates from installing, potentially exposing the system to other known vulnerabilities.

Impact on System Administrators and Users​

Administrators and IT professionals are now tasked with scanning for tampered directory junctions that redirect the “inetpub” folder or similar junctions created maliciously. The necessity to check this new vector adds to the already complex responsibilities of patch management and security maintenance.
For regular users, the presence of the inetpub folder might be benign and unnoticed, but it’s clear that deleting or tampering with it could have unintended security consequences. Microsoft advises strongly against deleting this folder because it is an active part of the update’s security infrastructure.
If users have removed the folder, Microsoft recommends restoring it by temporarily enabling IIS through the Windows features dialog, which recreates the folder with the proper permissions. Alternatively, uninstalling and reinstalling the April 2025 update also restores the folder and its protections.

Broader Reflections on the Patch and Update Strategy​

This incident exposes several wider issues in modern operating system security update practice:

• Complexity of Security Fixes: The fix for CVE-2025-21204 avoids patching vulnerable code directly, instead opting for a filesystem-level mitigation. This creative but unconventional approach underscores the increasing complexity of maintaining system security in expansive software platforms such as Windows.
• Trade-offs Between Usability and Security: The introduction of a new folder, especially one linked to IIS, confuses users and administrators alike. Though well-intentioned as a protective measure, the solution has introduced new risks and operational headaches—highlighting the challenge in balancing robust security with minimal disruption.
• Importance of Testing and Risk Assessment: The mklink /j junction exploit exposed by Beaumont suggests that Microsoft's update testing may have overlooked a fundamental attack scenario or edge case. Such oversights can undermine patch effectiveness and public confidence, emphasizing the need for rigorous and holistic security validation.
• Need For Clear Communication: The initial mystery and suspicion around the inetpub folder illustrate the importance of transparent, timely communication from software vendors about update contents and changes. Ambiguity leads to user confusion, unnecessary file deletions, and potential exposure.

Conclusion: Vigilance Required Amid Unconventional Fixes​

The April 2025 Windows 11 update’s inetpub folder symbolizes both innovation and the pitfalls in modern security patching. Microsoft’s strategy to thwart CVE-2025-21204 by pre-creating a secured folder on every system is ingenious in theory but has inadvertently introduced a new kind of vulnerability that can disable Windows Update processes without admin privileges.
For system administrators and security-conscious users, this calls for increased vigilance to monitor for suspicious directory junctions and maintain the integrity of the inetpub folder to ensure ongoing protection.
More broadly, this case study explains that complex operating systems require increasingly intricate defensive strategies—sometimes leveraging legacy components in new ways. However, with this complexity comes the risk of unexpected consequences, underscoring the perpetual need for comprehensive testing, thoughtful implementation, and open dialogue with the user community.
Microsoft has reportedly been notified about the new vulnerability, and users are awaiting a response or fix. Meanwhile, the best practice is clear: do not delete the inetpub folder, monitor for junction abuse, and keep systems updated via official, verified updates.
This episode is a reminder that in the evolving landscape of Windows security, every folder—even an empty, legacy-named one—can become a critical battleground.

---

References to community and official technical discussions surrounding this issue can be found in multiple Windows enthusiast and security forums with detailed analysis and practical guidance .

---

Source: Microsoft mystery folder fix might need a fix of its own

 

[ChatGPT]

Microsoft's latest Windows update, released in April 2025, has drawn significant attention—not merely due to new features or enhancements, but because of an unexpected empty folder named "inetpub" appearing suddenly on Windows 10 and Windows 11 systems. This folder’s emergence even on machines where Internet Information Services (IIS) is not installed sparked confusion and concern among users and IT professionals alike. Yet, rather than being a bug or leftover artifact, this folder is a calculated element of a critical security patch targeting a serious vulnerability known as CVE-2025-21204.

The Background of the “inetpub” Folder​

Traditionally, the "inetpub" directory is known chiefly to IIS administrators, housing web server files, logs, and website content. It is typically created only when IIS is explicitly enabled on a machine. The surprise appearance of an empty inetpub folder on systems without IIS has led many to question whether malware was at play or if Microsoft had inadvertently installed server components.
However, Microsoft quickly clarified that the creation of the inetpub folder is intentional and integral to Windows' defense against a recently disclosed elevation-of-privilege vulnerability residing in the Windows Process Activation service. This vulnerability involved the exploitation of symbolic link (symlink) handling within the Windows Update stack, which could allow attackers with local access to manipulate sensitive system files or even escalate privileges.
By preemptively creating the inetpub folder with locked-down system permissions, Microsoft sought to close off an avenue for symlink-based attacks—essentially creating a hardened “container” that secures file system paths and prevents redirection or unauthorized file manipulation.

Technical Details of CVE-2025-21204​

The CVE-2025-21204 vulnerability exploits Windows’ file system behavior, particularly how symbolic links are resolved during system operations like updates. Symbolic links are filesystem objects that point to other files or directories, allowing file operations to be redirected transparently. If mishandled, they provide a mechanism for attackers to redirect system calls to unintended targets.
In this specific vulnerability, an attacker with local access could create malicious symbolic links that might fool Windows Update components or other system processes into modifying or accessing files outside their intended scope, thereby escalating privileges or corrupting critical files.
Microsoft’s mitigation strategy, rather than patching the underlying code directly, took a more structural approach: ensuring that the inetpub directory exists by default with strict permissions. By doing so, symlink operations targeting this path could be controlled or neutralized, significantly raising the difficulty of successful exploitation.

Community Concerns and Misconceptions​

Many users, upon discovering inetpub on their system without having IIS enabled, reacted by deleting the folder, often thinking it was unnecessary or even malicious. Microsoft’s official guidance strongly cautions against such deletions. Removing the inetpub folder breaks the security assumptions embedded in the update and leaves the system vulnerable to the original exploit vector.
For users who have already deleted the folder, Microsoft recommends straightforward remediation: enabling IIS temporarily through the Control Panel’s “Turn Windows features on or off” interface, which recreates the folder with appropriate permissions. IIS can then be disabled if desired, but inetpub should be left intact to maintain system security. Alternatively, uninstalling and reinstalling the affected Windows update will also restore the folder.

The New Vulnerability Introduced by the Patch​

Interestingly, as the dust settled on the inetpub folder’s arrival, a noted security researcher, Kevin Beaumont, uncovered yet another security risk spawned by this fix. Using the Windows mklink command with the /j parameter, which creates directory junctions (a type of symlink), any local user—even without admin privileges—can create a junction that redirects the inetpub folder to another system location, such as a critical executable like Notepad.exe.
For example, by executing:
mklink /j c:\inetpub c:\windows\system32\notepad.exe
the inetpub directory becomes a junction redirecting to notepad.exe. When Windows Update or associated system components attempt to interact with or validate the inetpub folder, this redirection confuses them, causing update errors and failures that result in rollback of updates—effectively blocking patch installation and leaving machines exposed.
This scenario demonstrates a denial-of-service (DoS) vector where a non-admin user can disrupt the update process without needing elevated privileges. Given how easy it is to exploit, this exposure provoked strong concerns among sysadmins and security professionals.

Implications for IT Professionals and Users​

This unexpected fracture in Microsoft’s latest patch puts a spotlight on ongoing challenges in Windows update practices:

• Security Complexity: Modern operating systems have intricate security architectures that sometimes require unconventional measures, such as forcibly creating reserved folders, to mitigate attack surfaces.
• Patch Testing and Quality Assurance: The discovery that the patch designed to block one vulnerability introduced another exploit, especially one accessible by non-admin users, raises critical questions about Microsoft’s testing processes for security fixes.
• User and Admin Awareness: With folders like inetpub appearing arbitrarily and carrying security significance, users and admins must maintain vigilance and avoid premature deletion or modification of system components that might seem irrelevant.
• Monitoring for Tampering: Administrators may now need to verify the integrity of junction points (directory symlinks) within their Windows installations, especially c:\inetpub, to ensure it hasn’t been maliciously redirected.
• Communication and Transparency: Microsoft’s initial silence and delayed response to this secondary vulnerability underscore the importance of prompt communication and transparency regarding patches’ side effects.

Best Practices Moving Forward​

Given this situation, Windows administrators should take the following steps:

• Do Not Delete inetpub: Retain the folder as part of the security patch infrastructure.
• Scan for Junctions: Regularly check for suspicious junction points or symlinks in critical directories, especially c:\inetpub, to detect potential malicious redirections.
• User Privilege Management: Review and tighten user permissions to limit the capability of non-admin users creating junctions that could disrupt system operations.
• Apply Updates Cautiously: Monitor updates closely, including known vulnerabilities and newly discovered side effects, before a wide-scale rollout.
• Educate Users: Inform end-users and helpdesk staff about the importance of system folders and the risks of unauthorized modifications.
• Follow Official Guidance: Stay tuned for Microsoft’s forthcoming patches and advisories to address this vulnerability and related issues.

Conclusion​

Microsoft’s decision to introduce an empty inetpub folder as a mitigation for CVE-2025-21204 showcases the evolving and complex nature of Windows security patching. While innovative, this method introduced its own risk through the potential exploitation of directory junctions feasible by standard users.
This episode serves as a stark reminder that security patches themselves can sometimes become attack vectors if not thoroughly vetted. For system administrators and users, it underscores the ongoing necessity for caution, education, and proactive system monitoring in the face of ever-changing cybersecurity challenges.
Until Microsoft releases a definitive fix, vigilance around the inetpub folder and Windows Update processes remains essential to safeguard Windows systems from these intertwined vulnerabilities.

---

This feature has synthesized investigation from security researchers, reactions within the Windows enthusiast and administrator communities, and Microsoft’s official clarifications to provide a comprehensive understanding of the inetpub folder situation in the April 2025 Windows updates .

---

Source: Microsoft mystery folder fix might need a fix of its own