The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →If C:inetpub appeared after a Windows 11 update, leave it alone. Microsoft intentionally creates this folder as part of a security change associated with Windows 11 version 24H2 update KB5055523. Its presence does not mean that IIS was secretly installed, that your computer is infected, or that it is running a web server.
The important instruction is simple: do not delete, rename, move, or alter the permissions of the folder merely because it is empty or unfamiliar.
As an Amazon Associate I earn from qualifying purchases.
Quick answer
| Question | Answer |
|---|---|
Why did C:inetpub appear? |
It was created intentionally by a Windows security update, beginning with KB5055523 for Windows 11 version 24H2. |
| Is it malware? | No. The folder is an expected Windows update artifact. |
| Does it prove IIS is installed? | No. Microsoft says the folder can be created whether or not IIS is enabled. |
| Should you delete it? | No. Microsoft says to leave it in place regardless of whether IIS is active. |
| What if you already deleted it? | Microsoft provides an administrator PowerShell script that can recreate the folder and apply the expected permissions in supported situations. |
What KB5055523 changed
KB5055523 was released on April 8, 2025, for Windows 11 version 24H2. It brought the operating system to build 26100.3775 and was a monthly cumulative security and quality update. One visible consequence was the creation of a new directory at the root of the system drive, normally:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →C:inetpub
Microsoft’s release notes explain that the directory may be created even when Internet Information Services, or IIS, is not enabled. The relevant Microsoft support documentation continues to document this behavior for the update or a later Windows update.
#1 Best Overall
- Data recovery software for retrieving lost files
- Easily recover documents, audios, videos, photos, images and e-mails
- Rescue the data deleted from your recycling bin
- Prepare yourself in case of a virus attack
- Program compatible with Windows 11, 10, 8.1, 7
KB5055523 is now a historical update rather than a package that most users should manually seek out. Cumulative updates are normally delivered through Windows Update, Microsoft Update Catalog, or an organization’s managed update system. If you are troubleshooting a failed installation, check whether the package has been superseded rather than trying to install an old update unnecessarily. Microsoft’s Windows Update troubleshooting guidance covers that distinction.
Why does the folder exist?
Microsoft associates the folder with protections for CVE-2025-21204, a Windows Process Activation Elevation of Privilege vulnerability.
In plain English, the vulnerability involved improper link resolution before a file was accessed. This type of issue is sometimes described as unsafe link following. Under the right local conditions, an authorized attacker could potentially use the weakness to elevate privileges on the computer.
The vulnerability is not described as a remote attack in which someone on the internet can compromise any PC simply because the inetpub folder exists. The vulnerability has a local attack vector: an attacker would already need an appropriate foothold or local access. The National Vulnerability Database records CVE-2025-21204 with a CVSS 3.1 score of 7.8 High, with high potential impact to confidentiality, integrity, and availability. See the NVD vulnerability record for the technical classification.
Microsoft’s advisory says that affected updates create the %systemdrive%inetpub folder and that it should not be deleted, regardless of whether IIS is active. The safest interpretation is that Windows pre-creates and protects a path required by the mitigation. Microsoft documents the security purpose and the required presence of the directory, but does not publish every detail of a possible exploitation chain in the update notes. Claims that go beyond that documented explanation would be speculation.
Does inetpub mean IIS was installed?
No. The name is associated with IIS, Microsoft’s optional web-server platform, but the folder alone is not evidence that IIS was installed, enabled, configured, or serving a website.
On a computer that is actually using IIS, common default locations include:
%SystemDrive%inetpubwwwrootfor the default website’s web content;%SystemDrive%inetpublogsLogFilesfor IIS web-server logs; and- other IIS-managed directories depending on the installed roles, features, and administrator configuration.
Those are conventional IIS locations and can be changed. They should not be confused with the security-related directory that Windows Update may create on a system where IIS is not enabled.
To check IIS instead of guessing from the folder name:
- Open Settings.
- Go to System > Optional features and review the installed optional components.
- Alternatively, press Windows key + R, type
optionalfeatures, and press Enter to open the Windows Features dialog. - Look for IIS-related components such as Internet Information Services. Do not enable or disable components unless you know that change is appropriate for the computer.
The presence of C:inetpub is not a substitute for checking Windows’ optional-feature list. Microsoft documents IIS as an optional feature and provides installation information in its IIS feature documentation.
Should you delete, rename, move, or hide it?
No—leave the folder in its original location. Microsoft’s explicit guidance is not to delete it, even when IIS is disabled. An empty directory uses effectively negligible storage, so removing it provides no meaningful performance or disk-space benefit while potentially removing part of the intended security setup.
Do not:
- delete the folder to “clean up” Windows;
- rename it or move it to another drive;
- change its access-control permissions;
- replace it with a junction, symbolic link, or manually created substitute; or
- use a generic PC-cleaning utility to remove it.
These actions are not Microsoft’s documented consumer fix and could undermine the security purpose of the path. The folder is also not a replacement for antivirus protection, Microsoft Defender, Windows Update, or ordinary security maintenance.
If the folder is visually distracting in File Explorer, it is still safer to leave its location and permissions unchanged. Hiding or changing its visibility is an administrative customization, not a necessary repair step.
What to do if you already deleted it
If you removed C:inetpub, do not manually copy a similarly named folder from another PC and do not download an unverified repair script. Microsoft published the Set-InetpubFolderAcl script in the official PowerShell Gallery to restore the directory and its expected permissions in supported cases.
The package’s documented installation command is:
Install-Script -Name Set-InetpubFolderAcl -ForceUse an elevated PowerShell session and follow the instructions on Microsoft’s published PowerShell Gallery package. The package is authored by Microsoft under the IIS publisher identity.
The script is designed to:
- create the
inetpubdirectory if it is missing; - apply default IIS permissions when the directory is empty; and
- apply expected permissions to supported
DeviceHealthAttestationsubdirectories when applicable.
It also has an important safety behavior: if unexpected user-created subdirectories are present, it exits without changing those directories. That distinction matters:
Rank #2
- Dual USB-A & USB-C Bootable Drive – compatible with nearly all Windows PCs, laptops, and tablets (UEFI & Legacy BIOS). Works with Surface devices and all major brands.
- Fully Customizable USB – easily Add, Replace, or Upgrade any compatible bootable ISO app, installer, or utility (clear step-by-step instructions included).
- Complete Windows Repair Toolkit – includes tools to remove viruses, reset passwords, recover lost files, and fix boot errors like BOOTMGR or NTLDR missing.
- Reinstall or Upgrade Windows – perform a clean reinstall of Windows 7 (32bit and 64bit), 10, or 11 (amd64 + arm64) to restore performance and stability. (Windows license not included.). Includes Full Driver Pack – ensures hardware compatibility after installation. Automatically detects and installs drivers for most PCs.
- Premium Hardware & Reliable Support – built with high-quality flash chips for speed and longevity. TECH STORE ON provides responsive customer support within 24 hours.
- Missing or empty folder: Microsoft’s restoration script is the documented recovery route.
- Folder containing website, IIS, or application data: Do not blindly overwrite it. An IIS administrator should inspect the contents, permissions, and configuration first.
The script restores the folder’s expected state; it is not a general-purpose IIS repair tool and should not be presented as a universal fix for every Windows security problem.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What if the update itself caused a problem?
The appearance of C:inetpub is not, by itself, an update failure. If Windows Update is failing or the system has separate symptoms after an update, troubleshoot that problem independently.
1. Run Microsoft’s Windows Update troubleshooter
Start with the Get Help app’s Windows Update troubleshooter, or use the Windows Settings troubleshooting path:
Settings > System > Troubleshoot > Other troubleshooters > Windows Update > Run
Restart the computer and check Windows Update again. Microsoft’s Windows Update troubleshooter instructions provide the current interface guidance.
2. Repair Windows component and system files when symptoms justify it
For signs of corrupted Windows components or system files, open Command Prompt as administrator and run DISM first:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11DISM.exe /Online /Cleanup-image /RestorehealthWhen DISM completes, run:
sfc /scannowMicrosoft recommends this order because DISM can repair the component store that SFC uses. These commands address broader Windows servicing or system-integrity problems. They do not replace Microsoft’s ACL-aware script if you specifically deleted inetpub.
3. Do not uninstall the update solely because the folder appeared
There is no documented reason to remove KB5055523 or disable Windows Update simply because the directory is visible. If an update failed, produced a separate error, or caused a reproducible compatibility issue, use Microsoft’s update-recovery guidance and consider the installed update, its replacement status, and the actual error—not the folder’s existence—as the evidence to investigate.
Optional tools for unrelated Windows problems
If the computer has separate performance, disk-space, or general system-malfunction symptoms after you have used Microsoft’s native troubleshooting steps, a third-party diagnostic utility may be considered as an optional extra—not as a fix for inetpub or CVE-2025-21204.
Outbyte PC Repair documents support for Windows 11 and describes scans for certain system issues, missing updates, temporary files, and performance problems. It does not establish that the product restores Microsoft’s inetpub security permissions, repairs CVE-2025-21204, or should delete or modify the folder. Do not use a general PC-repair tool to change the directory’s permissions.
Free tools Windows power users keep installed
One-click scans. No signup required.
What the folder does—and does not—tell you
| If you see this | What it means |
|---|---|
An empty C:inetpub after Windows 11 24H2 updates |
Usually an intentional security-related directory created by Windows Update. |
wwwroot, IIS logs, or application files inside it |
There may be an IIS installation or application using the conventional path; investigate before changing anything. |
| The folder is absent because you deleted it | Use Microsoft’s documented Set-InetpubFolderAcl script in the appropriate supported situation. |
| A failed update, blue screen, or corrupted system files | A separate Windows servicing or system-integrity problem requiring troubleshooting. |
The folder does not prove that your PC is running a web server, does not indicate malware by itself, and does not guarantee protection against every local privilege-escalation technique. It is one component of a broader Windows security update.
Frequently Asked Questions
Was IIS secretly installed when Windows created C:inetpub?
No. Microsoft states that the folder can be created whether or not IIS is enabled. Check Windows Optional Features or the Windows Features dialog if you need to verify IIS separately.
Can I delete C:inetpub if it is empty?
You should not. Microsoft instructs users to leave the folder in place regardless of IIS status. Its storage footprint is negligible, and deleting it may remove part of the intended mitigation for CVE-2025-21204.
Is CVE-2025-21204 a remote attack from the internet?
It is classified as a local privilege-escalation vulnerability. The attacker would already need a suitable local foothold or authorized local access; simply knowing that the folder exists does not allow a remote compromise.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhat should I do if C:inetpub contains files?
Do not delete or overwrite the contents automatically. Conventional IIS locations such as wwwroot and LogFiles may contain website or server data. Have an IIS or system administrator inspect the installation and configuration first.
Will DISM and SFC recreate the inetpub folder?
They are designed to address Windows component and system-file corruption, not specifically to restore the folder’s security permissions. If you deleted inetpub, use Microsoft’s Set-InetpubFolderAcl package according to its official instructions.
The Bottom Line
Bottom line: C:inetpub is an intentional Windows 11 security-update folder associated with KB5055523 and CVE-2025-21204. It does not mean IIS was secretly enabled. Leave it where Windows created it, do not alter its permissions, and use Microsoft’s Set-InetpubFolderAcl script only if you already removed it and the documented recovery conditions apply.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
