- The April update for Windows 11 24H2 created a mysterious empty folder
- Some advised this could be deleted, but this isn’t actually the case
- If you delete the ‘inetpub’ folder, a security fix applied by the April patch won’t work, so you need to reinstate it if you removed the folder
Windows 11 24H2 users who were confused by a mysterious empty folder appearing on their system drive after applying the latest update for the OS should be aware that this is not a bug, but an intentional move – and that said folder shouldn’t be deleted.
In case you missed it, last week Windows 11 24H2 received its cumulative update for April 2025, and it created an ‘inetpub’ folder that was the source of some bewilderment or annoyance for those who noticed it.
You may also recall that some folks advised that it was fine to just delete the folder, not an unreasonable conclusion to reach seeing as it was empty, didn’t appear to do anything, and was related to Microsoft’s Internet Information Services (IIS) web server software for developers (and was appearing for those who didn’t have IIS installed).
Still, at the time, I advised that you removed it at your own risk and that it might be best left alone – seeing as it was empty and appeared harmless (and also just because you never quite know what’s going on with Windows). It seems I was right, as Microsoft has now warned against removing the folder, as noted at the outset.
Microsoft told Windows Latest that the folder is created as part of a security fix for a vulnerability that “can let local attackers trick the system into accessing or modifying unintended files or folders.”
In its advisory for this security patch, Microsoft notes: “After installing the updates listed in the Security Updates table for your operating system, a new [inetpub folder] will be created on your [system drive]. This folder should not be deleted, regardless of whether Internet Information Services (IIS) is active on the target device. This behavior is part of changes that increase protection and does not require any action from IT admins and end users.”
In short, it doesn’t matter whether you use IIS or not, you need to leave this folder alone. Without the folder being present, the mentioned security hole will remain present in Windows 11, offering attackers a potential opportunity to compromise your PC (at least if they are local to the device, meaning they have physical access).
Analysis: What if I’ve already deleted the folder, though?
This is an odd affair, and I assumed this was a bug when I wrote about it last week, since it seemed like a weird way of implementing a security fix. Of course, what Microsoft should have done is made it very clear in the release notes for this patch that it creates the folder and that users should leave it alone (while noting that it’s empty and harmless).
As I already observed, though, it’s best to proceed with caution when tinkering with Windows. What’s particularly strange about this affair is that there are reports in the past of this same folder being created, so maybe this was part of the implementation of security patches in these cases too – who knows.
What about if you’ve already deleted the folder? Well, in that case, you need to reinstate it, and Windows Latest is on hand with the solution. You need to open the Control Panel, then go into Programs > Programs and Features. On the left, you’ll see an option to ‘Turn Windows features on or off’ – click on this. Scroll down the alphabetical list of features and find ‘Internet Information Services’ and tick the box next to this, then click on the OK button.
The folder will now be recreated. If you did delete it last week, be sure to complete these steps.
