Introduction

In the April 2025 patch cycle for Windows 10 and Windows 11, many users and IT professionals noticed an unexpected newcomer on their systems: an empty folder named inetpub located at the root of the system drive (usually C:\). This puzzled users who traditionally associate this folder with Microsoft’s Internet Information Services (IIS) — a web server component typically present only on systems configured to run IIS.

This article delves into the reasons behind this sudden appearance, its connection to a critical security vulnerability known as CVE-2025-21204, implications for Windows security, and the mitigation strategy implemented by Microsoft, including newly discovered risks stemming from this mitigation.

Background: What is the inetpub Folder?

The inetpub folder has historically been part of IIS, Microsoft’s web server software. It houses web content, logs, and configuration files when IIS is installed and enabled.

However, starting with the April 2025 cumulative update (notably KB5055523 for Windows 11 and KB5055518 for Windows 10), this folder is created on all updated systems, regardless of IIS usage or installation.

Why is this folder now on every system?

Microsoft designed its creation as a security mitigation measure addressing a critical elevation-of-privilege vulnerability in Windows, identified as CVE-2025-21204.

Understanding CVE-2025-21204

The Vulnerability

CVE-2025-21204 targets the Windows Process Activation Service, an important component integrated deeply with Windows Update's servicing stack. The flaw concerns improper handling of symbolic links (symlinks), file system objects that act as references or shortcuts to other files or directories.

An attacker with local access could exploit this by crafting malicious symbolic links to redirect Windows Update operations to unauthorized locations. This could lead to:

  • Unauthorized modification or access to protected system files
  • Privilege escalation to gain higher system rights
  • Potential sabotage of update processes allowing attackers to prevent critical patches from installing

When Windows Update follows symlinks improperly, it may be tricked into writing files or staging updates in unintended places, possibly where attackers have privileges.

Microsoft’s Mitigation: The Role of the inetpub Folder

To combat CVE-2025-21204, Microsoft introduced a novel mitigation: it automatically creates an empty inetpub folder with tightly controlled system-level permissions.

This folder acts as a hardened, secure container—a "safe zone"—where Windows Update can stage files safely.

Key reasons for this approach include:

  • Utilizing a well-known, existing folder name and structure linked to IIS simplifies the application of strict security policies and access control lists (ACLs).
  • Creation of this controlled environment restricts where symbolic links can redirect operations.
  • It prevents attackers from exploiting missing or manipulated directories involved in updates.

Though the folder remains empty and takes minimal disk space, it forms a critical trust boundary that helps prevent symlink-based attacks against update operations.

The Unintended Consequence: Junction Point Exploit

Security researchers, notably Kevin Beaumont, discovered an unintended vulnerability introduced by this mitigation:

  • Users with standard (non-admin) privileges can replace the inetpub folder with a directory junction, a form of symlink specific to directories.
  • For example, using the command:

``INLINECODE0 ``

replaces the folder with a junction pointing to an arbitrary file (like Notepad.exe).

  • Since Windows Update’s servicing stack runs with SYSTEM privileges and implicitly trusts C:\inetpub without verifying if it is a junction or who owns it, it attempts to stage update files into the redirected (and incorrect) location.
  • This results in update failures, rollbacks, or hangs, which effectively constitute a local denial-of-service (DoS) attack on the update mechanism.

Such an attack requires no administrative permissions, making it easy for any local user or malware running under limited rights to sabotage critical updates.

Implications and Impact

  • For End Users: The unexpected folder and the vulnerability it aims to fix emphasize the need to trust and not remove update-introduced system objects. Deleting the inetpub folder compromises crucial protections.
  • For IT Administrators: This new attack vector highlights the importance of permissions management. Proper ACLs on the inetpub folder must be preserved or tightened to prevent symlink or junction tampering.
  • For Enterprises: The exploitation risk underscores the need for strict local user controls and endpoint security measures to prevent non-admin users from disrupting update processes.
  • On Systems Security: This incident illustrates the evolving challenges in securing OS update mechanisms, especially when balancing rapid patch deployment and architecture constraints.

Do Not Delete the inetpub Folder

  • Microsoft explicitly advises against removing the inetpub folder as it is integral to system security.
  • If deleted, users should restore it by either reinstalling the update or enabling IIS temporarily to regenerate the folder.

Lock Down Folder Permissions

  • Manually restrict write and delete permissions on C:\inetpub to only SYSTEM and TrustedInstaller accounts.
  • Disable permission inheritance and remove other users’ permissions, including administrators.
  • This prevents unauthorized creation of junctions or symbolic links modifying inetpub.

Monitor and Harden Endpoint Security

  • Limit and monitor local user permissions to prevent unauthorized command prompt or script usage.
  • Employ endpoint protection tools to detect abnormal symlink/junction creation.

Stay Updated

  • Keep Windows systems updated with the latest cumulative patches that may further address or improve this mitigation.
  • Follow official Microsoft advisories and security community updates for future fixes.

Conclusion

The sudden appearance of the inetpub folder in Windows 10 and 11 systems as part of the April 2025 update is not a bug, but a deliberate, well-thought-out security measure to mitigate a critical and subtle vulnerability involving symbolic link exploitation (CVE-2025-21204). While the folder strengthens Windows' defense against privilege escalation attacks, it has inadvertently introduced a novel exploitation method involving junction points, highlighting Windows' ongoing security complexity.

By understanding the roles and risks, users and administrators can better secure their systems—preserving update integrity and maintaining the overall security ecosystem in Windows environments.