Windows 11 April 2025 Update Introduces 'inetpub' Folder: Security Risks and How to Mitigate Them

The April 2025 Windows 11 update (KB5055523) introduces an empty 'inetpub' folder on all systems as a security mechanism against symbolic link exploits (CVE-2025-21204) in Windows Update. However, this folder can be exploited by local non-admin users through directory junction hijacking, potentially disrupting update processes. Users and administrators should secure the folder's permissions to maintain system security until Microsoft releases a complete fix.

Windows 11 'inetpub' Folder Security Risks and Mitigations After April 2025 Update

Introduction

The Windows 11 April 2025 cumulative update (notably KB5055523) has brought attention to an unexpected system change: the automatic creation of an empty folder named "inetpub" at the root of the system drive (usually C:). Traditionally linked with Internet Information Services (IIS), Microsoft's web server software, this folder now appears on nearly all systems, even those without IIS installed. While initially puzzling, Microsoft has clarified the folder's role as part of a critical security enhancement addressing a significant vulnerability (CVE-2025-21204) related to symbolic link handling in the Windows Update servicing stack.

This article provides an in-depth examination of the inetpub folder's security context, its associated risks, and recommended mitigations for users and IT administrators.

Background: Understanding the Inetpub Folder and Its New Role

Traditional Role of Inetpub

The "inetpub" folder has historically been the default directory for IIS, housing website content, logs, scripts, and other web resources. Its presence on a system indicated that IIS was installed and active, mostly on Windows Server or developer machines.

The April 2025 Change

With the April 2025 update, Microsoft started creating this folder by default on all Windows 11 devices, regardless of IIS installation. This change is a deliberate move tied to a security patch addressing CVE-2025-21204, a vulnerability related to how Windows Update handles symbolic links (symlinks).

The Vulnerability CVE-2025-21204 Explained

Symbolic links are file system objects that point to other files or directories. Improper handling of these links by Windows Update can allow attackers with local access (no admin rights required) to redirect operations to unauthorized locations. This can hinder update processes, allow privilege escalation, or cause system compromise by tampering with critical system files during update staging.

To mitigate this, Microsoft introduced the "inetpub" folder as a secured and trusted container for update staging operations. It is created with strict system-level permissions, owned and controlled exclusively by SYSTEM and TrustedInstaller accounts, ensuring only trusted processes can access or modify it.

Security Implications: A Double-Edged Sword

Protective Function of Inetpub

By establishing a fixed, permission-locked directory, Microsoft aimed to prevent attackers from substituting or redirecting the update staging area via symbolic links. The inetpub folder acts like a "safe zone" or a "digital moat," safeguarding the Windows servicing stack from malicious symlink exploitation.

Emerging Exploit: Directory Junction Hijacking

Despite these protective intentions, researchers, including security expert Kevin Beaumont, revealed a critical flaw: local users without administrative privileges can replace the "inetpub" folder with a directory junction—a special type of NTFS symbolic link—pointing to arbitrary files like system executables (e.g., Notepad.exe).

A typical exploit command is:

CODEBLOCK0

This redirection tricks the Windows servicing stack, which trusts "C:\inetpub" as a safe location, to operate on unintended targets. As a result, Windows Update operations fail, rollback, and cannot proceed, causing denial-of-service (DoS) conditions against the update system.

Since this does not require elevated privileges, any local user with standard access can disrupt system patching, potentially extending exposure windows to other vulnerabilities.

Mitigation and Best Practices

Immediate Workaround: Harden Inetpub Folder Permissions

Until Microsoft releases a definitive fix, users and administrators can manually harden the permissions of the "inetpub" folder to prevent unauthorized modifications:

Navigate to INLINECODE0 .
Right-click the folder, choose Properties.
Go to the Security tab and click Advanced.
Click Disable inheritance and then Remove all inherited permissions.
Add permissions explicitly for SYSTEM and NT SERVICE\TrustedInstaller accounts, granting them Full Control.
Remove all other user accounts' write and delete permissions, including local administrators.

This configuration blocks non-system users from creating directory junctions or deleting the folder, maintaining update integrity.

Restore Inetpub If Deleted

If the folder has been removed, it can be restored by:

Enabling IIS temporarily via Control Panel > Programs > Turn Windows Features On or Off and then disabling it again after the folder is recreated.
Reinstalling the April 2025 update (KB5055523), which recreates the folder with proper permissions.

Ongoing Monitoring

Stay updated with Microsoft's official advisories.
Educate users not to delete or modify the "inetpub" folder.
Maintain system backups to recover from accidental deletions or other issues.

Broader Implications

The "inetpub" folder saga highlights challenges in modern OS security:

Complex Defense Layers: Security increasingly relies on quiet, sometimes puzzling filesystem changes that serve critical protection roles beyond visible features.
Legacy System Repurposing: Microsoft repurposing a legacy IIS folder for security illustrates adaptive reuse but also surface risks.
Non-Admin Threat Vectors: The ability for non-admin users to cause disruption emphasizes stringent permission management and principle of least privilege.

These realities demand that both users and IT professionals exercise caution and awareness of underlying system changes when managing updates and security.

Conclusion

The Windows 11 April 2025 update introduced the "inetpub" folder as a vital security measure against symbolic link exploitation in Windows Update. While protecting against a serious vulnerability, the folder's presence brings a new local attack vector via directory junction hijacking, posing a denial-of-service risk to update reliability.

Until Microsoft provides a robust patch, strict permission management of the "inetpub" folder is the recommended mitigation to maintain system security and update fidelity. This episode underscores the nuanced and evolving landscape of modern OS security, where even an empty folder can play a pivotal role in defense—and conversely, in attack.