My new inetpub folder isn't empty! Anyone else?

Some info to be aware of re this folder:

Since I got the update, I deleted it, because I thought the folder was from a third-party application.

No worries, @braaphub. Just use the batch file at this post to create the folder and set the permissions.

pseymour said:

No worries, @braaphub. Just use the batch file at this post to create the folder and set the permissions.

Click to expand...

Thanks, I will try it

"This behavior is part of changes that increase protection and does not require any action from IT admins and end users. For more information, see CVE-2025-21204."

Let's correct that: Rather than correct a security flaw in our OS, we chose to create a folder almost no one needs (or they'd have it already) and let that fix the problem. Yeah, it's a half-assed solution to something we should fix, but hey, we're busy.".

i have changed the permissions on the inetpub folder to restrict access as much as possible
then i deleted the inetpub folder from 4 Windows systems and that's the way it will remain.

best of luck, Steve ..

hi i was curious about that folder so i enabled it to show...should i turn it off

pseymour said:

No worries, @braaphub. Just use the batch file at this post to create the folder and set the permissions.

Click to expand...

Thanks for your batch file. You just saved me a big headache here lol.

I am still suspicious of MS with this file actually being needed and intend to keep an eye on it.

Just checked... empty

antspants said:

Some info to be aware of re this folder:

Microsoft's official 'inetpub' folder lets hackers permanently block Windows updates on PCs

https://www.ghacks.net/2025/04/23/windows-empty-inetpub-folder-creates-a-new-security-problem/

www.elevenforum.com

Click to expand...

Microsoft just can't seem to help themselves!

This might only be tangentially related, but... Way back in the day when MS was coming out with their initial versions of IIS, the Inetpub directory and security became a major issue.

The Internet had just gone from "showcase html" sites to sites beginning to access databases and the like on servers.

All other web servers, which mostly meant Apache/Unix, had the web server isolated so that programs in the server directory (e.g. Inetpub) were not allowed anywhere above the root of the web server. That provided solid assurance that regardless of how good or bad web content security was, even executable code in the cgi-bin directory could not cause security issues on the server itself.

Over at MS, they had grand plans for integration of IIS with applications on a Windows NT server, mostly through technologies like ASP. However, in order to accomplish this, they allowed programs to call outside the Inetpub area and run other programs on the NT server. It was soon discovered that all an evil entity did had to do was to call core Windows programs from Inetpub. Full system access.

Of course, when this flaw was discovered and distributed around the world, MS worked to plug it up as fast as they might. It took some time. But this current debacle reminds me so much of that - an amateur hour mistake at MS creates a large security hole. You'd think that someone at MS would say "Hey, be careful with Inetpub... it can have intentional external public exposureand requires careful handling". But you'd be wrong.

Levitate11 said:

Of course, when this flaw was discovered and distributed around the world, MS worked to plug it up as fast as they might. It took some time. But this current debacle reminds me so much of that - an amateur hour mistake at MS creates a large security hole. You'd think that someone at MS would say "Hey, be careful with Inetpub... it can have intentional external public exposure and requires careful handling". But you'd be wrong.

Click to expand...

My guess is all the people that remember that debacle are gone.

Of course, Apache and nginx continue to have RCEs to this day, so there’s no need to run an executable on the host. You can just PUT your own code.

Discerp said:

Well, that's certainly easier than BleepingComputer's workaround which was to install IIS and then uninstall it.

Click to expand...

Apart from the fact that (at least that was the case for me, using Win10 22H2) one is also gifted with history and temp subfolders including their contents, this variant of the restoration process also sets the permissions differently compared to inetpub created by the update itself.

Does it make a difference? It probably shouldn’t.
But only Microsoft really knows — or maybe not.

pseymour's batch file is the better way!

Follow-up:
If you want the folder to be even more identical (same order of the DACLs) to the one created by the update, you can:

1. Using Notepad, save the following as "ACLFile.txt" in a directory of your choice. Important: Encoding: UTF-16 LE

2. Open Command Prompt with administrative privileges and navigate to the directory
3. Run: md C:\inetpub
4. Run: icacls C:\ /restore ACLFile.txt
5. Run: icacls C:\inetpub /setowner *S-1-5-18
6. Delete the ACLFile.txt by running: del ACLFile.txt