Protect Your Windows 11 System: Fixing the Inetpub Folder Vulnerability

Here is a summary and temporary fix for the Windows 11 "inetpub" folder vulnerability, based on the article you referenced:

Overview: Inetpub Folder Vulnerability​

Starting with the April 2025 Windows 11 update, a new empty inetpub folder is automatically created on every system at C:\inetpub. This was initially meant to close an old exploit, but it (ironically) introduced a new vulnerability:

• Any user (even non-admin) can use a directory junction (mklink /J) to redirect inetpub to another location.
• The Windows Servicing Stack (running as SYSTEM) doesn’t check for reparse points or ownership, so when updates interact with a maliciously redirected folder, updates can fail or roll back.
• Exploit example: A user runs mklink /J C:\inetpub C:\Windows\System32\notepad.exe — now, Windows Update will attempt to use Notepad instead of the intended folder, causing updates to break.

Temporary Solution (Until Microsoft Fixes It)​

You can protect your PC by restricting the permissions on the inetpub folder so only SYSTEM and TrustedInstaller have access. Here’s how:

• Right-click C:\inetpub and choose Properties.
• Go to the Security tab, then click Advanced.
• Click Disable inheritance, then choose Remove all inherited permissions from this object.
• Click Add, then Select a principal — type SYSTEM, hit Check Names, and then OK.
• Give it Full control permission and click OK.
• Repeat for NT SERVICE\TrustedInstaller (add it with Full control).
• Confirm all changes and exit.

Now, only Windows itself can alter the folder. If you need to revert permissions, just re-enable inheritance and delete SYSTEM and TrustedInstaller entries you added.

Note​

This fix should not interfere with normal Windows Update, but if you do have update issues, you may want to reset Windows Update components, or reverse the permission changes if all else fails.
Source and more details: maketecheasier.com - Windows Inetpub Folder Hackable & Fix

---

Source: Make Tech Easier https://www.maketecheasier.com/windows-inetpub-folder-is-hackable/&ved=2ahUKEwix68X1q_eMAxWtRjABHRmYH244FBDF9AF6BAgDEAI&usg=AOvVaw1-xuab-3u2JGXcO6B0vEuy/