Windows 11 update creates mysterious inetpub folder
Microsoft released security updates for Windows 11 and other company products earlier this week. If you have installed the security update on a Windows 11 PC, you may have noticed something peculiar after the mandatory restart.
After opening the root of drive C in File Explorer, you may have stumbled upon the inetpub folder, a newly created folder. The creation date and time of the folder aligns with the installation of the update. When you open it, you will notice that it is empty.
Update: Microsoft says here that the folder is created intentionally and that it should not be deleted. Reason: "This behavior is part of changes that increase protection and does not require any action from IT admins and end users".
Microsoft made no mention of the folder in the changelog, and it may not be clear immediately why the folder was created.
If you are a Windows veteran, you may remember that inetpub was the default folder for Microsoft Internet Information Services (IIS) on drive C of the computer. It was used by the service to storage website content.
Problem is, if you check under installed features, you may notice that Internet Information Services is not installed. IIS is not installed by default, which means that it requires manual activation. The update did not install the service automatically, which is good to know.
We observed the behavior -- unexpected creation of the inetpub folder -- on systems running Windows 11, version 24H2 after the update KB5055523 was installed on the devices. Our colleagues over at Neowin made the same observations.
So what happened?
Microsoft has not confirmed the issue on its end and it is unclear why the folder gets created when the update is installed. It is possible that something inside the update messed up and created the folder as a consequence.
In any event, the inetpub folder is not protected. You can remove it by right-clicking on it and selecting delete, or by selecting the folder and tapping on the delete key on the keyboard. Note that Microsoft advises against this.
Considering that the cause of the creation of the folder is unclear at this point, it is possible that it may reappear at a later point in time, for instance after installation of the next security update for Windows 11.
Now You: what is your take on this? Was it created by error during the installation of the update, or is there maybe another reason for its creation? Feel free to leave a comment down below.
Bleeping Computer have he indo how to recreate the folder if needed.
https://www.bleepingcomputer.com/news/security/microsoft-windows-inetpub-folder-created-by-security-fix-dont-delete/
I’m still looking for a detailed explanation of how creating an empty folder is going to increase security. I haven’t been able to find it anywhere.
More Microsoft clutter. M$ has no respect for end users and debris like this is a space-wasting mess. Just look at C:\Windows\WinSxS. Mine is currently at 7.67 GB and I just did a fresh reinstall of W10 Pro about a month ago! Personally, I think Windows has become such a cluttered mess of legacy code that they no longer can maintain it properly.
This directory contains Plug and Play drivers for most peripheries and internal components, in case you need to install/reinstall drivers and have no connection to Internet or Microsoft Website. This is actually one of the best ideas MS ever had, despite taking a ton of space.
Take ownership of the inetpub folder and remove all read/write access to it, except for your administrator account. Now Microsoft can’t put anything in it.
I took ownership of the folder, renamed it and deleted it. I am one of those people that if you tell me not to mess with something on my computer, I will do the opposite.
Proof again that Windows is not ready for the desktop.
See https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21204
After installing the updates listed in the Security Updates table for your operating system, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted regardless of whether Internet Information Services (IIS) is active on the target device. This behavior is part of changes that increase protection and does not require any action from IT admins and end users.
Relax, dudes…
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21204
“Added FAQ to explain that after installing the updates listed in the Security Updates table for your operating system, a new %systemdrive%\inetpub folder will be created on your device. **This folder should not be deleted regardless of whether Internet Information Services (IIS) is active on the target device.** This behavior is part of changes that increase protection and does not require any action from IT admins and end users.”
When Microsoft says “This folder should not be deleted “, it most certainly should be deleted. If it was of any importance, security-wise, they would have made it undeletable.
Microsoft’s “explanation” is no explanation at all. Question: How does the presence of an empty directory “increase protection”? Answer: It doesn’t.
Bottom line is, not even Microsoft can tell us why C:\inetpub was added to computers. All they’ve done is to admit they put it there. That’s as lame as lame can get, and in now way illuminates this mystery.
This applies to Windows 10 as well.
Windows Server 2008 R2 extended updates (Windows 7) installs this folder as well.
I’m seeing the same on my Windows 7 Ultimate PC with R2 extended updates.
The file is apparently used by Internet Information Services with some users having the folder installed and in use on their computers since 2018. The unusual thing about the current installation via the security update is that it’s now being installed on computers where IIS is either not installed or disabled.
Same on Windows 10 22H2. Inetpub created during yesterday’s patch.
I got the folder after the 24h2 April update. Will be interesting to see if its recreated if someone deletes it on their PC. These days, hard to say what’s going on if intentional or done by mistake with Microsoft.
That’s Earth-shattering!
“WORLDS ARE COLLIDING!!!”
I can confirm that this inetpub folder is also created on Windows 10 IoT Enterprise LTSC.
From BleepingComputer: However, Microsoft told BleepingComputer that the folder was intentionally created and should not be removed.
—
Didn’t we hear them remaking Recall into CoPilot Vision? Maybe making the desktop computer an internet host will make it easier for Microsoft to spy on you with Recall.
Windows 10 19045.5737 too have it…
Not really an issue since it can be deleted; an article mention may be appropriate, but a tutorial on how to fully enable and use IIS would be most beneficial:
https://www.makeuseof.com/iis-website-local-test-host/
https://csharp-developer.com/step-by-step-guide-setting-up-iis-on-windows-11/
A tutorial on setting up the OpenSSH server with guides on making keys and where to place them, etc. for use as a VPN when away from home.
gHacks used to do a lot of that.
I’m beginning to think that windows of any kind has faults. I have issues with some of my ham radio programs with windows update
Disable windows update if you want stability. Has been true for 15+ years, keep up mate.
Windows is genuinely better not updated… I work at an MSP that supports 80+ companies. You still have all the security measures in place, of course – but this is just anti-windows yapping – sad to say you guys. don’t know a thing.
You would think that working at an MSP that supports more than 80+ companies, i would understand that security measures need to come in from updates.
I got this folder on Windows 10 22H2 after latest M$ update.
I’m running Win11 23H2 and got this folder, too.
Shows on Win 10 Pro Version 22H2. Folder Date Modified 4/8/2025.
Windows 10 Pro 22H2 Build 19045.5737.
It’s an empty folder, found it annoying,
which I deleted after the update.
What was that, or worth keeping for…?