My new inetpub folder isn't empty! Anyone else?

Mac Mac · Apr 14, 2025

Hi All,

I've been reading about the new inetpub folder after installing KB5055523 and I have it but mine are not empty but contain 2 folders, history & temp.
Both of these have files in them...

The history folder has numbered folders named "CFGHISTORY_0000000031 etc which I can't open.
The temp folder has another folder called appPools and has numbered tmp files named APC4CE3.tmp etc and bindingInfo.tmp in them.

I don't have ISS enabled so I'm not sure why my folder isn't empty like everyone else?

Anyone else got the same files in there as me?

Windows 11 24H2 (OS Build 26.100.3775)

Thanks

Mac

PerpetualCycle · Apr 14, 2025

Don't remove it according to this:

Microsoft: Windows 'inetpub' folder created by security fix, don’t delete

Microsoft has now confirmed that an April 2025 Windows security update is creating a new empty "inetpub" folder and warned users not to delete it.

www.bleepingcomputer.com

Berton · Apr 14, 2025

I got the folder on 4/8 but it is empty.

Ghot · Apr 14, 2025

I deleted my inetpub folder and am leaving it deleted.

I believe my 4/8/2025 backup (made right after the 4/8 update), has that folder still.

Yep... I just checked. The inetpub folder is in the backup.

garlin · Apr 14, 2025

MS just admitted the Servicing Stack was stupid, and previously followed symlinks when there was no need to do so. Great job!

Wolfzz · Apr 14, 2025

Microsoft warns that anyone who deleted mysterious folder that appeared after latest Windows 11 update must take action to put it back

Microsoft warns that anyone who deleted mysterious folder that appeared after latest Windows 11 update must take action to put it back

Mystery folder is actually tied to a security fix – so if you thought it did nothing and deleted it, think again

www.techradar.com

bn40400 · Apr 14, 2025

Wolfzz said:
Microsoft warns that anyone who deleted mysterious folder that appeared after latest Windows 11 update must take action to put it back

Microsoft warns that anyone who deleted mysterious folder that appeared after latest Windows 11 update must take action to put it back

Mystery folder is actually tied to a security fix – so if you thought it did nothing and deleted it, think again

www.techradar.com

I was just about to delete it too because I forgot to after updating the other day lol Glad I didn't....Thanks for the heads up. But yes, I do have configuration files in it anyways; so I would've more than likely just kept it. I will hide the folder though.

pseymour · Apr 14, 2025

Here's a little batch to create the folder and set the permissions, in case that matters.

Batch:

@echo off

if exist C:\inetpub goto eof

echo Creating C:\inetpub...
mkdir C:\inetpub

echo Removing inherited permissions...
icacls C:\inetpub /reset /t /c /l /q
icacls C:\inetpub /inheritance:r

echo Administrators...
icacls C:\inetpub /grant:r *S-1-5-32-544:F > nul 2>&1
icacls C:\inetpub /grant *S-1-5-32-544:(OI)(CI)(IO)(F) > nul 2>&1

echo SYSTEM...
icacls C:\inetpub /grant *S-1-5-18:F > nul 2>&1
icacls C:\inetpub /grant *S-1-5-18:(OI)(CI)(IO)(F) > nul 2>&1

echo Trusted Installer...
icacls C:\inetpub /grant *S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464:F > nul 2>&1
icacls C:\inetpub /grant *S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464:(OI)(CI)(IO)(F) > nul 2>&1

echo Users...
icacls C:\inetpub /grant *S-1-5-32-545:(RX) > nul 2>&1
icacls C:\inetpub /grant *S-1-5-32-545:(OI)(CI)(IO)(GR,GE) > nul 2>&1

echo Creator Owner...
icacls C:\inetpub /grant *S-1-3-0:(OI)(CI)(IO)(F) > nul 2>&1

echo Setting owner to SYSTEM.
icacls C:\inetpub /setowner *S-1-5-18 /t /c /l /q

:eof

Ghot · Apr 14, 2025

Well, I just restored from my April 8th backup.
The inetpub folder is back and is empty.

However... I don't trust MS concerning this.
I'm watching you, Microsoft. ^^

Discerp · Apr 14, 2025

pseymour said:

Here's a little batch to create the folder and set the permissions, in case that matters.

Batch:

@echo off

if exist C:\inetpub goto eof

echo Creating C:\inetpub...
mkdir C:\inetpub

echo Removing inherited permissions...
icacls C:\inetpub /reset /t /c /l /q
icacls C:\inetpub /inheritance:r

echo Administrators...
icacls C:\inetpub /grant:r *S-1-5-32-544:F > nul 2>&1
icacls C:\inetpub /grant *S-1-5-32-544:(OI)(CI)(IO)(F) > nul 2>&1

echo SYSTEM...
icacls C:\inetpub /grant *S-1-5-18:F > nul 2>&1
icacls C:\inetpub /grant *S-1-5-18:(OI)(CI)(IO)(F) > nul 2>&1

echo Trusted Installer...
icacls C:\inetpub /grant *S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464:F > nul 2>&1
icacls C:\inetpub /grant *S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464:(OI)(CI)(IO)(F) > nul 2>&1

echo Users...
icacls C:\inetpub /grant *S-1-5-32-545:(RX) > nul 2>&1
icacls C:\inetpub /grant *S-1-5-32-545:(OI)(CI)(IO)(GR,GE) > nul 2>&1

echo Creator Owner...
icacls C:\inetpub /grant *S-1-3-0:(OI)(CI)(IO)(F) > nul 2>&1

echo Setting owner to SYSTEM.
icacls C:\inetpub /setowner *S-1-5-18 /t /c /l /q

:eof

Well, that's certainly easier than BleepingComputer's workaround which was to install IIS and then uninstall it.

suatcini54 · Thursday at 3:12 AM

%systemdrive%\inetpub directory is very empty here even after I I unchecked "Hide protected system files" and selected "Show hidden files, folders and drives".

Brink · Thursday at 9:20 AM

[OS Security] After installing this update or a later Windows update, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted regardless of whether Internet Information Services (IIS) is enabled on the target device. This behavior is part of changes that increase protection and does not require any action from IT admins and end users. For more information, see CVE-2025-21204.

KB5055523 Windows 11 Cumulative Update build 26100.3775 (24H2) - April 8

Microsoft Support: April 8, 2025 - KB5055523 (OS Build 26100.3775) For information about Windows update terminology, see types of Windows updates and the monthly quality update types. To find an overview of Windows 11, version 24H2, see its update history page. Be sure to follow @WindowsUpdate...

www.elevenforum.com

Skeptic Mike · Friday at 11:13 AM

Brink said:
For more information, see CVE-2025-21204.

Which says this is an "Elevation of Privilege" issue. An ordinary user can make a change to something which will make a separate process running with higher privileges perform an action using those privileges which can then be exploited.

In this case: "Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally." In a normal Windows installation users can create folders in the root of the system drive. e.g. create an inetpub directory, which they can populate as they wish, or make point to a different directory. The "Windows Update Stack" will apparently follow this malicious setting.

The update creates an inetpub directory with the following security, which prevents ordinary users from changing it in any way as they only have read permissions.

pseymour said:
Here's a little batch to create the folder and set the permissions, in case that matters.

This should produce a directory with the permissions shown. They do matter.

Scott · Friday at 1:11 PM

Mac Mac said:
Anyone else got the same files in there as me?

Yup.

Taliseian · Friday at 1:19 PM

Curious if any of the people who have files in their inetpub folder are Edge or Chromium users.

I run Firefox and my folder is empty. Not sure if this is related.

gunrunnerjohn · Friday at 1:44 PM

Mine is still empty, I have no idea what fills it.

Mac Mac · Friday at 2:23 PM

Scott said:
Yup.

View attachment 131538

Phew! I thought it was just me!

Cheers for posting Scott.

Marcus Vinicus · Friday at 2:26 PM

The folder is there because of this vulnerability.

Security Update Guide - Microsoft Security Response Center

msrc.microsoft.com

Getting into a bit of a funk and deleting the folder like some users are doing is a storm in a teacup afaik

BrianInEngland · Friday at 2:45 PM

Mine is empty, running Edge Beta and Firefox browsers

Winuser · Friday at 4:53 PM

Taliseian said:
Curious if any of the people who have files in their inetpub folder are Edge or Chromium users.

I run Firefox and my folder is empty. Not sure if this is related.

The folders are empty on both of my computers that are running 24H2. I haven't installed any browsers so they are using the Edge browser.

My new inetpub folder isn't empty! Anyone else?

Member

My Computer

Syzygy

My Computers

Ret. ATC

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

Microsoft warns that anyone who deleted mysterious folder that appeared after latest Windows 11 update must take action to put it back​

My Computer

Active member

Microsoft warns that anyone who deleted mysterious folder that appeared after latest Windows 11 update must take action to put it back​

My Computer

freshly showered

My Computers

Well-known member

My Computers

Member

My Computer

Active member

My Computers

Administrator

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Member

My Computer

Semper paratus

My Computers

Well-known member

My Computer

Well-known member

My Computers

Similar threads

Microsoft warns that anyone who deleted mysterious folder that appeared after latest Windows 11 update must take action to put it back

Microsoft warns that anyone who deleted mysterious folder that appeared after latest Windows 11 update must take action to put it back