Microsoft has launched a PowerShell script to assist restore an empty ‘inetpub’ folder created by the April 2025 Home windows safety updates if deleted. As Microsoft beforehand warned, this folder helps mitigate a high-severity Home windows Course of Activation privilege escalation vulnerability.
In April, after putting in the brand new safety updates, Home windows customers out of the blue discovered that an empty C:Inetpub folder was created. As this folder is related to Microsoft’s Web Info Server, customers discovered it complicated that it was created when the net server was not put in.
This brought on some individuals to take away the folder, making them susceptible once more to the patched vulnerability. Microsoft mentioned that customers who eliminated it can manually recreate it by putting in Web Info Companies from the Home windows “Flip Home windows Options on or off” management panel.
As soon as IIS is put in, a brand new inetpub folder might be added to the foundation of the C: drive, with information and the identical SYSTEM possession because the listing created by the April Home windows safety updates. Additionally, in the event you do not use IIS, you possibly can uninstall it utilizing the identical Home windows Options management panel to take away it, leaving the C:inetpub folder behind.
On Wednesday, in a brand new replace to the CVE-2025-21204 advisory, the corporate additionally shared a remediation script that helps admins re-create this folder from a PowerShell shell utilizing the next instructions:
Set up-Script -Title Set-InetpubFolderAcl
C:Program` FilesWindowsPowerShellScriptsSet-InetpubFolderAcl.ps1
As Redmond explains, the script will set the proper IIS permissions to forestall unauthorized entry and potential vulnerabilities associated to CVE-2025-21204.
It’ll additionally replace entry management record (ACL) entries for the DeviceHealthAttestation listing on Home windows Server techniques to make sure it’s safe if created by the February 2025 safety updates.
Microsoft: “Do not delete it.”
The safety flaw (CVE-2025-21204) mitigated by this inetpub folder (mechanically created by April’s safety updates even on techniques the place the IIS net server platform was not beforehand put in) is attributable to an improper hyperlink decision concern within the Home windows Replace Stack.
This possible signifies that Home windows Replace might comply with symbolic hyperlinks on unpatched gadgets in a approach that may let native attackers trick the OS into accessing or modifying unintended information or folders.
Microsoft says profitable exploitation permits attackers with low privileges to escalate permissions and manipulate or carry out file administration operations within the context of the NT AUTHORITYSYSTEM account.
Whereas eradicating the folder didn’t trigger points utilizing Home windows in our exams, Microsoft advised BleepingComputer it was deliberately created and shouldn’t be deleted. Redmond issued the identical warning in an up to date advisory for the CVE-2025-21204 safety flaw to warn customers to not delete the empty %systemdrivepercentinetpub folder.
“This folder shouldn’t be deleted no matter whether or not Web Info Companies (IIS) is energetic on the goal system. This conduct is a part of adjustments that improve safety and doesn’t require any motion from IT admins and finish customers,” the corporate cautioned.
Cybersecurity professional Kevin Beaumont additionally demonstrated that non-admin customers can abuse this folder to dam Home windows updates from being put in by making a junction between C:inetpub and any Home windows file.
Patching used to imply complicated scripts, lengthy hours, and countless fireplace drills. Not anymore.
On this new information, Tines breaks down how fashionable IT orgs are leveling up with automation. Patch sooner, scale back overhead, and give attention to strategic work — no complicated scripts required.
