Microsoft has launched a PowerShell script to assist restore an empty ‘inetpub’ folder created by the April 2025 Home windows safety updates if deleted. As Microsoft beforehand warned, this folder helps mitigate a high-severity Home windows Course of Activation privilege escalation vulnerability.
In April, after putting in the brand new safety updates, Home windows customers all of the sudden discovered that an empty C:Inetpub folder was created. As this folder is related to Microsoft’s Web Data Server, customers discovered it complicated that it was created when the net server was not put in.
This brought on some individuals to take away the folder, making them weak once more to the patched vulnerability. Microsoft stated that customers who eliminated it can manually recreate it by putting in Web Data Companies from the Home windows “Flip Home windows Options on or off” management panel.
As soon as IIS is put in, a brand new inetpub folder will probably be added to the basis of the C: drive, with recordsdata and the identical SYSTEM possession because the listing created by the April Home windows safety updates. Additionally, when you do not use IIS, you possibly can uninstall it utilizing the identical Home windows Options management panel to take away it, leaving the C:inetpub folder behind.
On Wednesday, in a brand new replace to the CVE-2025-21204 advisory, the corporate additionally shared a remediation script that helps admins re-create this folder from a PowerShell shell utilizing the next instructions:
Set up-Script -Identify Set-InetpubFolderAcl
C:Program` FilesWindowsPowerShellScriptsSet-InetpubFolderAcl.ps1As Redmond explains, the script will set the right IIS permissions to forestall unauthorized entry and potential vulnerabilities associated to CVE-2025-21204.
It’s going to additionally replace entry management listing (ACL) entries for the DeviceHealthAttestation listing on Home windows Server programs to make sure it’s safe if created by the February 2025 safety updates.
Microsoft: “Do not delete it.”
The safety flaw (CVE-2025-21204) mitigated by this inetpub folder (mechanically created by April’s safety updates even on programs the place the IIS net server platform was not beforehand put in) is brought on by an improper hyperlink decision subject within the Home windows Replace Stack.
This seemingly implies that Home windows Replace might observe symbolic hyperlinks on unpatched gadgets in a means that may let native attackers trick the OS into accessing or modifying unintended recordsdata or folders.
Microsoft says profitable exploitation permits attackers with low privileges to escalate permissions and manipulate or carry out file administration operations within the context of the NT AUTHORITYSYSTEM account.
Whereas eradicating the folder didn’t trigger points utilizing Home windows in our assessments, Microsoft informed BleepingComputer it was deliberately created and shouldn’t be deleted. Redmond issued the identical warning in an up to date advisory for the CVE-2025-21204 safety flaw to warn customers to not delete the empty %systemdrivepercentinetpub folder.
“This folder shouldn’t be deleted no matter whether or not Web Data Companies (IIS) is lively on the goal gadget. This habits is a part of modifications that enhance safety and doesn’t require any motion from IT admins and finish customers,” the corporate cautioned.
Cybersecurity professional Kevin Beaumont additionally demonstrated that non-admin customers can abuse this folder to dam Home windows updates from being put in by making a junction between C:inetpub and any Home windows file.
Patching used to imply advanced scripts, lengthy hours, and countless hearth drills. Not anymore.
On this new information, Tines breaks down how fashionable IT orgs are leveling up with automation. Patch sooner, scale back overhead, and give attention to strategic work — no advanced scripts required.