The In-Depth Guide to Windows' inetpub Folder: Security, Vulnerabilities, and Mitigation in 2025

Introduction

With the April 2025 cumulative updates for Windows 10 and Windows 11, notably KB5055523, Microsoft introduced an unexpected but critical security feature: the automatic creation of the "inetpub" folder at the root of system drives. Traditionally tied to Internet Information Services (IIS) web server platforms, this empty "inetpub" folder now appears on most Windows systems—even those without IIS installed. Though initially puzzling users and administrators alike, it represents a sophisticated defensive strategy related to a serious security vulnerability known as CVE-2025-21204.

This article explores the origins, security implications, and emerging vulnerabilities tied to the "inetpub" folder, along with practical mitigation strategies for both enterprise and individual users.

Background and Context

What is the Inetpub Folder?

The "inetpub" directory has traditionally served as the default root directory for IIS, Microsoft's web server software, used to store web content, scripts, and configuration files. In typical usage, "inetpub" appears only when IIS is explicitly installed and enabled.

However, starting with the April 2025 Windows cumulative update for both Windows 10 and 11, the "inetpub" folder is automatically created on virtually every system drive regardless of the IIS installation status. This new behavior is neither a bug nor malware but a deliberate security design.

CVE-2025-21204: The Underlying Vulnerability

CVE-2025-21204 is a local elevation-of-privilege vulnerability involving the improper handling of symbolic links (symlinks) within the Windows Update servicing stack. Symlinks are filesystem objects pointing to other files or directories and can be exploited if the system improperly resolves or validates them.

The vulnerability allows an attacker with local access to create malicious symlinks (or directory junctions) that redirect critical Windows Update file operations to unauthorized locations. This can disrupt update processes, escalate privileges, or allow persistent compromises.

Microsoft’s Security Strategy: The Inetpub Folder as a Safe Container

To thwart exploitation, Microsoft introduced the "inetpub" folder as a hardened, controlled environment with strict system-level permissions granted only to accounts like SYSTEM and TrustedInstaller.

This folder acts as a "safe zone" where Windows servicing processes can stage update-related files without the risk of malicious symlink redirection. By creating a trusted boundary in the filesystem, Microsoft implemented security-by-design—shifting part of the defense to filesystem structure and permissions instead of relying solely on code-level patches.

Technical Details and Exploitation Risks

How the Inetpub Folder Protects the System

  • The folder is empty and minimalistic by design.
  • It is secured with NTFS permissions that provide exclusive control to system-level processes.
  • Windows Update expects this folder to exist and trusts its path as non-manipulable.

The Junction Point Exploit: A New Vulnerability

Ironically, security researcher Kevin Beaumont discovered that any local, non-admin user can manipulate the "inetpub" folder by replacing it with a directory junction pointing to an arbitrary file or folder, for example:

CODEBLOCK0

This redirects Windows Update's servicing stack (running with SYSTEM privileges) to this unintended location, causing update staging failures, rollbacks, or denial-of-service. It effectively blocks patching without requiring admin rights, enabling attackers or unauthorized parties to impede security updates.

Root Causes and Limitations

  • The servicing stack does not validate the "inetpub" folder’s status as a reparse point or symbolic link.
  • Ownership and reparse point verification are deficient, allowing junction substitution.
  • The security measure unintentionally opened a new local denial-of-service attack vector.

Implications and Impact

  • Enterprise environments and managed systems face challenges maintaining compliance if updates are blocked.
  • Systems vulnerable to the junction exploit may remain unpatched against other critical threats.
  • The exploit demonstrates complexities in modern Windows security, where fixes can inadvertently create new attack surfaces.

Recommendations and Mitigation Strategies

What Users and Administrators Should Do Now:

  1. Do Not Delete the Inetpub Folder: Microsoft explicitly warns against removing the "inetpub" folder; doing so disables essential security protections.
  2. Restore the Folder If Deleted:
  • Enable IIS temporarily via "Turn Windows Features on or off" to recreate it.
  • Reinstall the April 2025 update to recreate the folder with correct permissions.
  1. Lock Down Permissions to Mitigate the Junction Exploit:
  • Navigate to INLINECODE0 .
  • Right-click, select Properties → Security → Advanced.
  • Disable inheritance and remove all permissions.
  • Explicitly grant Full Control only to SYSTEM and NT SERVICE\TrustedInstaller.
  • This prevents non-system users (including administrators) from creating junction points there.
  1. Monitor Microsoft Updates and Advisories: Stay current with patches that address this vulnerability more comprehensively.
  2. Educate Users: Prevent accidental deletion or modification of this critical folder in organizational settings.

Conclusion

The "inetpub" folder’s re-emergence on Windows systems after the April 2025 updates underscores the complexity of modern OS security. Initially intended as a protective safeguard against symbolic link attacks related to CVE-2025-21204, it paradoxically introduced a new threat vector exploitable by local users without elevated privileges.

Microsoft’s approach highlights a strategic pivot to securing filesystem structures alongside traditional patching but also reveals the fragility of relying on seemingly trivial system artifacts for defense.

Until Microsoft issues a definitive patch, users and system administrators must maintain vigilance by preserving the "inetpub" folder, enforcing strict permissions, and carefully monitoring update behaviors to ensure robust protection against emerging local threats.