


Windows 11's New Inetpub Folder is Hackable. Try This Temporary Fix - Make Tech Easier
May 14, 2025 pm 04:09 PMWe previously discussed how the inetpub folder in Windows is crucial and should not be deleted due to security concerns. Ironically, the presence of this folder poses a security risk in itself. It's surprisingly simple for even non-administrative users to manipulate this folder, potentially compromising your PC's security. Let's delve into how the inetpub folder can be exploited and what you can do to protect your system until Microsoft offers a permanent fix.
How Can the Inetpub Folder Be Exploited?
Starting with the April 2025 cumulative update for Windows 11, an empty inetpub folder is now created in the C drive. This update aimed to fix a vulnerability that allowed attackers to use absent directories to insert symlinks into the Windows Update stack. However, attackers can still exploit this by replacing the folder with a directory junction, causing Windows Update to target the wrong location and fail.
Any user with access to your PC can execute a simple command without admin rights to alter the inetpub folder's final directory. As noted by security expert Kevin Beaumont, executing the command mklink /J C:\inetpub C:\Windows\System32\notepad.exe can redirect the folder to point to Notepad or any other file, leading to Windows update failures.
Internally, the Windows Servicing Stack operates as SYSTEM and regards C:\inetpub as a secure directory. It does not verify for reparse points or ownership, so when it attempts to place files there and encounters a junction to a file, the update process either fails or reverts.
A Temporary Fix for This Vulnerability
Microsoft has yet to address this vulnerability or confirm if a solution will be included in future updates. In the meantime, you can implement measures to reduce the risk of this vulnerability being exploited.
Creating a directory junction necessitates write/delete permissions on the parent folder. By removing these permissions from all user accounts, while still allowing SYSTEM and TrustedInstaller to retain them, you prevent any non-system process (including admins) from using mklink /J on “C:\inetpub”. Here’s how to do it:
On the C drive, right-click the inetpub folder and choose Properties.
Navigate to the Security tab and click on Advanced at the bottom.
Click Disable inheritance, and when prompted, select Remove all inherited permissions from this object.
Click Add, then Select a principal. In the next window, type SYSTEM, click Check Names, and then OK.
Under Basic permissions, choose Full control and click OK.
Repeat the Add principal process, this time entering NT SERVICE\TrustedInstaller, granting Full control, and clicking OK. Close all windows by clicking OK.
Now, no users can access or modify the folder, and any attempt will trigger a Windows permission denied message. Windows and its updater will still have access to update the PC.
To undo these changes, revisit the Advanced Security Settings window, click Enable inheritance, and then Apply.
This action will restore the original permissions. Simply delete the manually added SYSTEM and TrustedInstaller entries by selecting them and clicking Remove.
This approach should safeguard your PC until Microsoft resolves the vulnerability. The adjusted permissions should facilitate smooth Windows updates. If you encounter issues with Windows updates, consider resetting the Windows update components before reverting these permissions.
The above is the detailed content of Windows 11's New Inetpub Folder is Hackable. Try This Temporary Fix - Make Tech Easier. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

The problem of slow booting can be solved by the following methods: 1. Check and disable unnecessary booting programs; 2. Turn off the quick boot function; 3. Update the driver and check disk health; 4. Adjust the number of processor cores (only for advanced users). For Windows 11 systems, first, the default self-start software such as QQ and WeChat are disabled through the task manager to improve the startup speed; if you use dual systems or old hardware, you can enter the power option to turn off the quick boot function; second, use the device manager to update the driver and run the chkdsk command to fix disk errors, and it is recommended to replace the mechanical hard disk with SSD; for multi-core CPU users, the kernel parameters can be adjusted through bcdedit and msconfig to optimize the startup efficiency. Most cases can be corrected by basic investigation

If you're having trouble reading your desktop icons' text or simply want to personalize your desktop look, you may be looking for a way to change the font color on desktop icons in Windows 11. Unfortunately, Windows 11 doesn't offer an easy built-in

Fixed Windows 11 Google Chrome not opening Google Chrome is the most popular browser right now, but even it sometimes requires help to open on Windows. Then follow the on-screen instructions to complete the process. After completing the above steps, launch Google Chrome again to see if it works properly now. 5. Delete Chrome User Profile If you are still having problems, it may be time to delete Chrome User Profile. This will delete all your personal information, so be sure to back up all relevant data. Typically, you delete the Chrome user profile through the browser itself. But given that you can't open it, here's another way: Turn on Windo

When Windows cannot detect a second monitor, first check whether the physical connection is normal, including power supply, cable plug-in and interface compatibility, and try to replace the cable or adapter; secondly, update or reinstall the graphics card driver through the Device Manager, and roll back the driver version if necessary; then manually click "Detection" in the display settings to identify the monitor to confirm whether it is correctly identified by the system; finally check whether the monitor input source is switched to the corresponding interface, and confirm whether the graphics card output port connected to the cable is correct. Following the above steps to check in turn, most dual-screen recognition problems can usually be solved.

Have problems uploading files in Google Chrome? This may be annoying, right? Whether you are attaching documents to emails, sharing images on social media, or submitting important files for work or school, a smooth file upload process is crucial. So, it can be frustrating if your file uploads continue to fail in Chrome on Windows PC. If you're not ready to give up your favorite browser, here are some tips for fixes that can't upload files on Windows Google Chrome 1. Start with Universal Repair Before we learn about any advanced troubleshooting tips, it's best to try some of the basic solutions mentioned below. Troubleshooting Internet connection issues: Internet connection

Mini PCs have undergone

Microsoft's latest Windows updates can generally be installed safely, but they need to be judged based on the update type and usage scenario. Ordinary users can update their daily office work, video watching, etc. directly; professional software or game users should be cautious. Regular quality updates (such as the monthly "Tuesday Patch") have low risks, so it is recommended to install them in time; updates to functions (such as large version upgrades) may cause compatibility issues. It is recommended to back up data, confirm software and hardware support, and check community feedback before installing. Overall, quality updates are safe and reliable, and functional updates are suitable for optional installation after observation.
