Bottom line: A mitigation for CVE-2025-21204 quietly creates C:\inetpub on every supported Windows build.
Security researcher Kevin Beaumont has shown that any standard (non-admin) user can replace that folder with a junction (mklink /j) that points to a single file. The Windows servicing stack then:

assumes the mitigation is already present,
refuses to apply the rest of the update bundle, and
throws 0x800F081F (CBS_E_SOURCE_MISSING) on every future patch attempt. (Windows "inetpub" security fix can be abused to block future updates, Microsoft mystery folder fix might need a fix of its own • The Register)

Why This Is Bigger Than a One-Off Glitch

Risk	Impact	Notes
Patch-denial DoS	Keeps an endpoint frozen at April 2025 levels	No privilege-escalation needed; ideal for insider threat or malware staging. (Windows "inetpub" security fix can be abused to block future updates)
Silent in inventories	C:\inetpub looks legitimate, so most asset scans pass	Junctions keep the same path but change the reparse-point tag.
Don’t-delete dilemma	Deleting a rogue junction also deletes the folder… which re-opens CVE-2025-21204 and can confuse Windows Update even more	Microsoft explicitly warns not to remove the folder. (Microsoft: Windows 'inetpub' folder created by security fix, don’t delete, Understanding the 'inetpub' Folder and CVE-2025-21204 Mitigation in ...)

Detection: Spot Bad Junctions Without Breaking the Fix

# Lists ONLY inetpub entries that are junctions, not real folders

Get-Item -LiteralPath C:\inetpub -ErrorAction SilentlyContinue |

Where-Object { $_.Attributes -band [IO.FileAttributes]::ReparsePoint } |

Format-List FullName,LinkType,Target

Intune / Defender XDR hunting (example KQL):
DeviceFileEvents | where FolderPath =~ @"C:\inetpub" and FileAttributes has "REPARSE_POINT"

Safe Remediation Flow

Back up: snapshot or restore point.
Remove only the junction (e.g., rmdir C:\inetpub), immediately recreate a real folder:
New-Item -Path C:\inetpub -ItemType Directory -Force
icacls C:\inetpub /inheritance:r /grant:r "SYSTEM:(OI)(CI)(F)" "Administrators:(OI)(CI)(F)"
Re-run Windows Update (wuauclt /detectnow or via your RMM).
Harden:

WDAC/AppLocker: block cmd.exe /c mklink for standard users.
FSRM: alert on reparse-point changes under C:\.
SIEM watchlists: raise critical if 0x800F081F appears after April 2025.

Deleting the folder without recreating it—or leaving a broken junction in place—can leave systems both unpatched and vulnerable to the original privilege-escalation flaw. (Understanding the 'inetpub' Folder and CVE-2025-21204 Mitigation in ...)

Microsoft’s Position & Outlook

Severity: Moderate (MSRC closed Beaumont’s ticket, no hotfix scheduled). (Windows "inetpub" security fix can be abused to block future updates)
Guidance: “Do not delete inetpub; future servicing stack updates will refine the behavior.” (Microsoft: Windows 'inetpub' folder created by security fix, don’t delete)

Given the ease of exploitation and the strategic advantage of a stealthy patch-freeze, we expect this to be folded into a future Servicing Stack Update (SSU). Until then, the burden is on administrators to monitor and repair junction abuse promptly.

Need Help?

ECS Technology Solutions can automate discovery, recreate the proper ACLs at scale, and validate patch compliance across Intune, SCCM, or any RMM platform. Reach out if you’d like a scripted audit or bulk remediation plan.

Stay patched—and stay cautious.