Windows 10 and Windows 11 users who installed the April Patch Tuesday updates may have noticed a new “inetpub” folder on their system drive, which Microsoft warns should not be deleted.
The “inetpub” folder is associated with Microsoft’s Internet Information Services (IIS), a component for hosting a website on a PC. However, the folder is not created for IIS purposes but is part of a security fix for the CVE-2025-21204 security flaw. This flaw involves improper handling of symbolic links, which could be exploited by attackers to access or modify certain files and folders.
The CVE-2025-21204 security flaw is a significant vulnerability that required patching. Microsoft failed to initially communicate why the “inetpub” folder was added, leading to confusion among Windows users and likely prompting many to delete the folder. To address this confusion, Microsoft clarified that the folder should not be removed, regardless of whether IIS is active on the target device.
According to Microsoft, “After installing the updates listed in the Security Updates table for your operating system, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted regardless of whether Internet Information Services (IIS) is active on the target device. This behavior is part of changes that increase protection and does not require any action from IT admins and end users.”
If a user has already deleted the “inetpub” folder, it can be restored by enabling IIS through the Windows Features settings in the Control Panel. To do this, users can launch Control Panel in icon view, select the Programs and Features applet, click “Turn Windows features on or off,” check the option for “Internet Information Services,” and click OK. This will recreate the “inetpub” folder and apply the necessary security protections.
Enabling IIS and recreating the “inetpub” folder will create some files and subfolders, but they occupy very little disk space. Microsoft has updated its advisory to clarify the purpose of the folder and prevent further confusion among users. The company has not publicly explained why the folder needed to be named “inetpub,” which has caused confusion among Windows users.
