Microsoft: Windows 'inetpub' folder created by security fix, don’t delete

Microsoft has now confirmed that an April 2025 Windows security update is creating a new empty "inetpub" folder and warned users not to delete it. This folder is typically used by Microsoft's Internet Information Services (IIS), a web server platform that can be enabled via the Windows Features dialog to host websites and web apps. However, after installing this month's cumulative updates, many Windows users have found a newly created C:\inetpub folder on their systems, although IIS wasn't installed during the process. BleepingComputer has confirmed this behavior on our Windows 11 and Windows 10 systems and discovered that the cumulative update creates the folder using the SYSTEM account. Even though deleting the folder did not cause issues using Windows in our tests, Microsoft told BleepingComputer on Thursday that this empty folder had been intentionally created and should not be removed. However, according to user reports, the April cumulative updates will fail to install if the C:\inetpub directory is created before update deployment. While Redmond still has to explain why the security updates are creating this folder in the first place, the company updated the advisory for a Windows Process Activation elevation of privilege vulnerability (tracked as CVE-2025-21204) overnight to warn users not to delete the new empty inetpub folder on their hard drives. "After installing the updates listed in the Security Updates table for your operating system, a new %systemdrive%\inetp...