Don't delete that mystery empty folder. Windows put it there as a security fix

vaxvms

Full story at https://www.theregister.com/2025/04/14/windows_update_inetpub/

Canny Windows users who’ve spotted a mysterious folder on hard drives after applying last week’s security patches for the operating system can rest assured – it’s perfectly benign. In fact, it’s recommended you leave the directory there.

The folder, typically C:\inetpub, is empty and related to Microsoft’s Internet Information Services (IIS). It will be created when you install the security patches whether or not you’re using that optional web server. The purpose of the folder is to mitigate an exploitable elevation-of-privileges flaw within Windows Process Activation, classified as CVE-2025-21204.

“This folder should not be deleted regardless of whether Internet Information Services (IIS) is active on the target device. This behavior is part of changes that increase protection and does not require any action from IT admins and end users.”

px_eliezer_

vaxvms

Meant to post that, I forgot.

Microsoft assumes that nobody looks at their computer folders and registry settings….

Which is a stupid policy…

They should put clear names on folders, and proactively tell users about new files that are being added to the OS, and new startup entries too.

urbanriot

px_eliezer_

Microsoft assumes that nobody looks at their computer folders and registry settings….

Yep, I’d already deleted it on a pile of machines thinking someone had previously enabled IIS, disabled it, and the folder was left behind. Microsoft is so useless these days.

Somewhat-Reticent

Were auto-cleaner app maintainers notified in advance?

antdude

What happens if it is deleted?

Rich221976

antdude What happens if it is deleted?

The world as we know it will end. /s.

I haven’t really used windows much.

OmegaWolf747

Just checked my root folder and there it is! I’ll leave it as suggested.

Rook

I don’t want to delete the folder, but I would like to set it to “hidden.”
I’ve been googling and haven’t found if that would break anything.

vaxvms

antdude

What happens if it is deleted?"

The security patch that installed it won’t work?
Putting the folder back is very simple. The article shows how to do it.

InternetJeff

Jeeze, what a kludge for a “security” update, creating random folders on people’s PCs.

px_eliezer_

InternetJeff

Agree.

I know that they’ve done the same thing before.

I can’t bring up any specific examples now, but I know they’ve done it.

What is especially stupid of Microsoft in this regard is that millions of users have software that scans for empty folders so that they can be deleted!

vaxvms

Well, well, well
Microsoft mystery folder fix might need a fix of its own
Full story can be had at https://www.theregister.com/2025/04/24/microsoft_mystery_folder_fix/?td=rt-3a

Turns out Microsoft’s latest patch job might need a patch of its own, again. This time, the culprit is a mysterious inetpub folder quietly deployed by Redmond, now hijacked by a security researcher to break Windows updates.

The folder, typically c:\inetpub, reappeared on Windows systems in April as part of Microsoft’s mitigation for CVE-2025-21204, an exploitable elevation-of-privileges flaw within Windows Process Activation. Rather than patching code directly, Redmond simply pre-created the folder to block a symlink attack path. For many administrators, the reappearance of this old IIS haunt raised eyebrows, especially since the mitigation did little beyond ensuring the folder existed.

For at least one security researcher, in this case Kevin Beaumont, the fix also presented an opportunity to hunt for more vulnerabilities. After poking around, he discovered that the workaround introduced a new flaw of its own, triggered using the mklink command with the /j parameter.

InternetJeff

This is comical. Peak Windows was version 7, and it’s been all downhill since then.

antdude

InternetJeff This is comical. Peak Windows was version 7, and it’s been all downhill since then.

2K was the best of all!

Somewhat-Reticent

Change the attack vector and cut off updates - classic.

vaxvms

Microsoft shares script to restore inetpub folder you shouldn’t delete
https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-script-to-restore-inetpub-folder-you-shouldnt-delete/

Microsoft has released a PowerShell script to help restore an empty ‘inetpub’ folder created by the April 2025 Windows security updates if deleted. As Microsoft previously warned, this folder helps mitigate a high-severity Windows Process Activation privilege escalation vulnerability.