Lately, a mysterious empty folder called “inetpub” has been appearing
on Windows machines after recent Microsoft security updates. Some were
old enough to remember that this folder was part of the installation
of Internet Information Server, which was Microsoft’s attempt to
compete with the open-source heavyweights in the web server world. It
was a product that was infamous for its security vulnerabilities, so
when people saw this familiar name reappear out of the dead past, it
was no surprise that some went “Aieeee! Security hole! Delete!
Delete!”.
But it turns out that this is no bug, it’s a feature! It is somehow a required part of Microsoft’s current security mechanisms for Windows.
(How? Why? Nobody seems able to explain ...) And not only that, if you
delete it (accidentally or otherwise), you cannot simply fix things by recreating a folder in the same location with the same name.
Instead, you have to go through the rigmarole of downloading and
running some PowerShell script that Microsoft helpfully provides <https://www.tomshardware.com/software/windows/if-you-deleted-that-mysterious-windows-file-microsoft-told-you-not-to-theres-a-new-script-to-restore-it>.
Even running the script is not a straightforward process: it requires
the entry of several cumbersome and error-prone shell commands.
dirVolume in drive C is W11HOME
On Mon, 6/9/2025 7:58 PM, Lawrence D'Oliveiro wrote:
Lately, a mysterious empty folder called “inetpub” has been appearing
on Windows machines after recent Microsoft security updates. Some were
old enough to remember that this folder was part of the installation
of Internet Information Server, which was Microsoft’s attempt to
compete with the open-source heavyweights in the web server world. It
was a product that was infamous for its security vulnerabilities, so
when people saw this familiar name reappear out of the dead past, it
was no surprise that some went “Aieeee! Security hole! Delete!
Delete!”.
But it turns out that this is no bug, it’s a feature! It is somehow a
required part of Microsoft’s current security mechanisms for Windows.
(How? Why? Nobody seems able to explain ...) And not only that, if you
delete it (accidentally or otherwise), you cannot simply fix things by
recreating a folder in the same location with the same name.
Instead, you have to go through the rigmarole of downloading and
running some PowerShell script that Microsoft helpfully provides
<https://www.tomshardware.com/software/windows/if-you-deleted-that-mysterious-windows-file-microsoft-told-you-not-to-theres-a-new-script-to-restore-it>.
Even running the script is not a straightforward process: it requires
the entry of several cumbersome and error-prone shell commands.
dirVolume in drive C is W11HOME
Volume Serial Number is
Directory of C:\
Mon, 06/12/2023 03:19 AM <DIR> AMD
Thu, 11/24/2022 06:13 PM <DIR> boot
Sun, 07/17/2022 12:33 PM <DIR> cygwin
Mon, 05/23/2022 10:49 PM 12,288 DumpStack.log
Thu, 12/19/2024 07:57 PM <DIR> ESD
Wed, 04/09/2025 02:05 AM <DIR> inetpub <=== very pretty, I saw that...
Sat, 04/23/2022 11:17 PM <DIR> MinGW
Sat, 05/07/2022 01:24 AM <DIR> PerfLogs
Mon, 06/09/2025 11:07 PM <DIR> Program Files
Sat, 05/10/2025 06:40 PM <DIR> Program Files (x86)
Wed, 02/16/2022 11:06 AM 357,548 Reflect_Install.log
Wed, 05/28/2025 09:05 AM 94 rescuepe.log
Wed, 05/28/2025 08:00 AM <DIR> Temp
Thu, 09/22/2022 06:16 AM <DIR> Users
Wed, 05/14/2025 12:40 AM <DIR> Windows
I didn't spend more than about five seconds thinking about that when
I saw it. I just... moved on.
*******
I don't see anyone taking credit for this cheese&cracker spree.
https://www.powershellgallery.com/packages/Set-InetpubFolderAcl/1.0/Content/Set-InetpubFolderAcl.ps1
$sddlInetpub = "O:SYG:SYD:P(A;CIOI;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;BA)(A;CIOI;GRGX;;;BU)(A;CIOI;GA;;;CO)"
It's better to print them out stacked. Now, compare to the Security tab on the thing.
$sddlInetpub = "O:SYG:SYD:P
(A;CIOI;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)
(A;CIOI;GA;;;SY)
(A;CIOI;GA;;;BA)
(A;CIOI;GRGX;;;BU)
(A;CIOI;GA;;;CO)"
And roughly translated, that means:
"Don't fuck with me, I have the death sentence on twelve planets."
Apparently, that SID is well known (written on the bathroom wall at the pub).
S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464 = Trusted Installer's SID
If they would only bring back FAT32, we wouldn't have to do this.
Paul
On Tue, 10 Jun 2025 01:14:27 -0400, Paul <[email protected]d> wrote in <1028evl$129fb$[email protected]>:
On Mon, 6/9/2025 7:58 PM, Lawrence D'Oliveiro wrote:
Lately, a mysterious empty folder called “inetpub” has been appearing >>> on Windows machines after recent Microsoft security updates. Some wereVolume in drive C is W11HOME
old enough to remember that this folder was part of the installation
of Internet Information Server, which was Microsoft’s attempt to
compete with the open-source heavyweights in the web server world. It
was a product that was infamous for its security vulnerabilities, so
when people saw this familiar name reappear out of the dead past, it
was no surprise that some went “Aieeee! Security hole! Delete!
Delete!”.
But it turns out that this is no bug, it’s a feature! It is somehow a
required part of Microsoft’s current security mechanisms for Windows.
(How? Why? Nobody seems able to explain ...) And not only that, if you
delete it (accidentally or otherwise), you cannot simply fix things by
recreating a folder in the same location with the same name.
Instead, you have to go through the rigmarole of downloading and
running some PowerShell script that Microsoft helpfully provides
<https://www.tomshardware.com/software/windows/if-you-deleted-that-mysterious-windows-file-microsoft-told-you-not-to-theres-a-new-script-to-restore-it>.
Even running the script is not a straightforward process: it requires
the entry of several cumbersome and error-prone shell commands.
dir
Volume Serial Number is
Directory of C:\
Mon, 06/12/2023 03:19 AM <DIR> AMD
Thu, 11/24/2022 06:13 PM <DIR> boot
Sun, 07/17/2022 12:33 PM <DIR> cygwin
Mon, 05/23/2022 10:49 PM 12,288 DumpStack.log
Thu, 12/19/2024 07:57 PM <DIR> ESD
Wed, 04/09/2025 02:05 AM <DIR> inetpub <=== very pretty, I saw that...
Sat, 04/23/2022 11:17 PM <DIR> MinGW
Sat, 05/07/2022 01:24 AM <DIR> PerfLogs
Mon, 06/09/2025 11:07 PM <DIR> Program Files
Sat, 05/10/2025 06:40 PM <DIR> Program Files (x86)
Wed, 02/16/2022 11:06 AM 357,548 Reflect_Install.log
Wed, 05/28/2025 09:05 AM 94 rescuepe.log
Wed, 05/28/2025 08:00 AM <DIR> Temp
Thu, 09/22/2022 06:16 AM <DIR> Users
Wed, 05/14/2025 12:40 AM <DIR> Windows
I didn't spend more than about five seconds thinking about that when
I saw it. I just... moved on.
*******
I don't see anyone taking credit for this cheese&cracker spree.
https://www.powershellgallery.com/packages/Set-InetpubFolderAcl/1.0/Content/Set-InetpubFolderAcl.ps1
$sddlInetpub = "O:SYG:SYD:P(A;CIOI;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;BA)(A;CIOI;GRGX;;;BU)(A;CIOI;GA;;;CO)"
It's better to print them out stacked. Now, compare to the Security tab on the thing.
$sddlInetpub = "O:SYG:SYD:P
(A;CIOI;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)
(A;CIOI;GA;;;SY)
(A;CIOI;GA;;;BA)
(A;CIOI;GRGX;;;BU)
(A;CIOI;GA;;;CO)"
And roughly translated, that means:
"Don't fuck with me, I have the death sentence on twelve planets."
Could you translate that into something more technical?
with his buddy's arm on the barroom floor, and I'd like to avoid any
Imperial entanglements.)
Can I remove the ACL for the trusted installer, for example? Hey, wait a second...
Okay, just had a conversation with ChatGPT, which says I can completely remove
the ACL and I won't have to worry about anything trying to use the funny directory.
What do you think? Will that prevent scurrilous ruffians from haxoring my Windows virtual machine?
Lately, a mysterious empty folder called inetpub has been appearing
on Windows machines after recent Microsoft security updates.
Lately, a mysterious empty folder called “inetpub” has been appearing
on Windows machines after recent Microsoft security updates. Some were
old enough to remember that this folder was part of the installation
of Internet Information Server, which was Microsoft’s attempt to
compete with the open-source heavyweights in the web server world. It
was a product that was infamous for its security vulnerabilities, so
when people saw this familiar name reappear out of the dead past, it
was no surprise that some went “Aieeee! Security hole! Delete!
Delete!”.
But it turns out that this is no bug, it’s a feature! It is somehow a required part of Microsoft’s current security mechanisms for Windows.
(How? Why? Nobody seems able to explain ...) And not only that, if you
delete it (accidentally or otherwise), you cannot simply fix things by recreating a folder in the same location with the same name.
Instead, you have to go through the rigmarole of downloading and
running some PowerShell script that Microsoft helpfully provides <https://www.tomshardware.com/software/windows/if-you-deleted-that-mysterious-windows-file-microsoft-told-you-not-to-theres-a-new-script-to-restore-it>.
Even running the script is not a straightforward process: it requires
the entry of several cumbersome and error-prone shell commands.
On Mon, 9 Jun 2025 23:58:35 -0000 (UTC), Lawrence D'Oliveiro
<[email protected]d> wrote
Lately, a mysterious empty folder called inetpub has been appearing
on Windows machines after recent Microsoft security updates.
I have it, where the folder has a date of 3/6/2025 but I have no idea what
it is used for. Mine isn't empty though.
dir /s/a/l/on/b inetpub
c:\inetpub\custerr
c:\inetpub\temp
c:\inetpub\custerr\en-us
c:\inetpub\custerr\en-us\500-100.asp
c:\inetpub\temp\apppools
c:\inetpub\temp\iis temporary compressed files c:\inetpub\temp\apppools\apc1690.tmp
c:\inetpub\temp\apppools\apc17c9.tmp
c:\inetpub\temp\apppools\apc1846.tmp
c:\inetpub\temp\apppools\apc1855.tmp
c:\inetpub\temp\apppools\apc7cb.tmp
c:\inetpub\temp\apppools\apcc4f.tmp
c:\inetpub\temp\apppools\apcef03.tmp
c:\inetpub\temp\apppools\apcf898.tmp
c:\inetpub\temp\apppools\apcfaea.tmp
c:\inetpub\temp\apppools\apcfe26.tmp
c:\inetpub\temp\apppools\bindinginfo.tmp
Can someone just give me the best way to get rid of it safely?
Can someone just give me the best way to get rid of it safely?
Can someone just give me the best way to get rid of it safely?
On Tue, 10 Jun 2025 12:11:56 -0400, Oscar wrote:
Can someone just give me the best way to get rid of it safely?
You can’t. It’s needed for the Windows security mechanism to work.
Lawrence D'Oliveiro <[email protected]d> wrote at 23:35 this Tuesday (GMT):
On Tue, 10 Jun 2025 12:11:56 -0400, Oscar wrote:
Can someone just give me the best way to get rid of it safely?
You can’t. It’s needed for the Windows security mechanism to work.
That seems like a really dumb and insecure bandaid fix.
Joel <[email protected]> wrote:
Is it easy for people who *don't* listen to your bullshit about using
Gentoo and LFS, nimrod?
That should be, "Is it easy for people who listen to [...]"
Paul <[email protected]d> wrote:
Is it easy for people who *don't* listen to your bullshit about using
Gentoo and LFS, nimrod?
That should be, "Is it easy for people who listen to [...]"
I actually recommend Gentoo to people too. Just
for the Gentoo Handbook. It's an easy recipe to follow
up to a point.
When I've run Gentoo, it works best if you use it every
day. The fun happens if you don't boot it for six months,
then you attempt to catch up on "changes" over the six months.
The first time I got stuck in a "cant-go-forward",
"cant-go-back" package management issue, there were
comments about using biases to get out of it. I actually
managed to escape, and it was all working again.
But the package manager just kept getting thicker and
thicker. The next time I got caught in one of those
situations, I couldn't figure out how to escape and
keep the package management working.
I even set up a DISTCC server on my second PC that had
more cores (possibly the six core Test Machine), to help
my weaker daily driver do a make world. You need the same
distro state on both, for that to work.
It's fun as a technical challenge, but when something
breaks, it can be past my pay scale to fix. It's still
educational, and will make you more familiar with the
file tree.
I've been hacking things like that for a long time. My group,
working on UNIX boxes, we had sweet fuck all for software to
use at work. We didn't even have a web browser, when web
browsers first came out. Imagine trying to use Lynx to
collect engineering data fro electronics sites. But we used
to build our own novelty softwares in the X11R4/X11R5 era.
One department had their own X11R5 tree. I could have set one
up, but I didn't want too many questions about it. When they
caught me building a browser from source, they made me delete it.
That may have been NCSA Mosaic.
I just think it's absurd to try to manually set up the OS, if the idea
is to have a modern OS. Larry's system is so rudimentary. It's
impossible to understand why he treasures it, the obsession with
compiling relative to his exact hardware, etc. Debian with Cinnamon
gives one a Windows-like environment in Linux. It's just not
customizable to the Nth degree. He's stupid, retarded, obsessive. He
just needs to get a life.
I even set up a DISTCC server on my second PC that had
more cores (possibly the six core Test Machine), to help
my weaker daily driver do a make world. You need the same
distro state on both, for that to work.
On 13/06/2025 3:03 pm, Paul wrote:
<Snip>
I even set up a DISTCC server on my second PC that had
more cores (possibly the six core Test Machine), to help
my weaker daily driver do a make world. You need the same
distro state on both, for that to work.
WHY?? Why do you have your 'Power' machine (possibly the six core Test Machine) sitting in the Backroom twiddling its thumbs whilst you use your weaker daily driver do a make world??
Paul wouldn't it be better to have all the power at your finger-tips and let the 'lessor' machine do all the non-time critical stuff??
On Thu, 6/12/2025 11:10 AM, candycanearter07 wrote:
Lawrence D'Oliveiro <[email protected]d> wrote at 23:35 this Tuesday (GMT):
On Tue, 10 Jun 2025 12:11:56 -0400, Oscar wrote:
Can someone just give me the best way to get rid of it safely?
You can’t. It’s needed for the Windows security mechanism to work.
That seems like a really dumb and insecure bandaid fix.
I'm surprised they didn't set the Hidden attribute on it.
Paul
Paul <[email protected]d> wrote at 00:27 this Friday (GMT):
On Thu, 6/12/2025 11:10 AM, candycanearter07 wrote:
Lawrence D'Oliveiro <[email protected]d> wrote at 23:35 this Tuesday (GMT): >>>> On Tue, 10 Jun 2025 12:11:56 -0400, Oscar wrote:
Can someone just give me the best way to get rid of it safely?
You can’t. It’s needed for the Windows security mechanism to work.
That seems like a really dumb and insecure bandaid fix.
I'm surprised they didn't set the Hidden attribute on it.
Paul
They DIDN'T?? That seems like a disaster waiting to happen.
cd /d C:\Windows\System32\drivers\Volume in drive C is W11HOME
dir /ah PROCMON2*
What people don't know (because they can't see it), is a
"procmon23.sys" or similar, is added to System32, and that module is
loaded at boot time. Since the Hidden bit is set on it, people can't
see it, and the program does not clean up after itself and remove
the file again. When the API changes, the version is bumped to "procmon24.sys".
On Fri, 13 Jun 2025 18:50:22 -0400, Paul wrote:
What people don't know (because they can't see it), is a
"procmon23.sys" or similar, is added to System32, and that module is
loaded at boot time. Since the Hidden bit is set on it, people can't
see it, and the program does not clean up after itself and remove
the file again. When the API changes, the version is bumped to
"procmon24.sys".
What a clunky way of versioning shared libraries.
The Linux way is twofold: add a versioning suffix to the name of the
library, and also versioning the individual symbols themselves. This way
the name of the library in the SDK doesn’t need to change.
The file was named that way by Russinovich, the developer.
And he does his own file injection. If he finds the procmon23.sys he
removes it and installs the procmon24.sys. It's a private file just for
him, not shared in the conventional sense. It's not tracked and updated
by Windows Side By Side (WinSXS). Windows is not supposed to know it is there, it's not loaded on boot, but it is used privately for doing a
trace.
Just as Linux keeps some kernels,and if the latest kernel won't boot,
you can use the menu to select a slightly older one.
On Fri, 13 Jun 2025 22:53:33 -0400, Paul wrote:
The file was named that way by Russinovich, the developer.
And he does his own file injection. If he finds the procmon23.sys he
removes it and installs the procmon24.sys. It's a private file just for
him, not shared in the conventional sense. It's not tracked and updated
by Windows Side By Side (WinSXS). Windows is not supposed to know it is
there, it's not loaded on boot, but it is used privately for doing a
trace.
It’s pretty scary to think one lone developer can inject such code into Windows that Windows itself does not know about.
Just as Linux keeps some kernels,and if the latest kernel won't boot,
you can use the menu to select a slightly older one.
The Linux kernel itself knows which version it is, though. Nothing is
being hidden from it.
Preemptive multitasking allows a lot more rubbish to load.
Why, the OS even runs the programs I write :-/ You know,
some commercial AV tools, they would gun down my EXE files
and not allow them to run ("reputation" detection, never
seen the hash before).
And Microsoft is aware of these issues, as they are writing
out third party drivers (Ring0). They are working on improving
the walls of their cardboard fortress in Ring0.
On 14/06/2025 7:02 pm, Paul wrote:
<Snip>
Preemptive multitasking allows a lot more rubbish to load.
Why, the OS even runs the programs I write :-/ You know,
some commercial AV tools, they would gun down my EXE files
and not allow them to run ("reputation" detection, never
seen the hash before).
And Microsoft is aware of these issues, as they are writing
out third party drivers (Ring0). They are working on improving
the walls of their cardboard fortress in Ring0.
So would this put them in the same boat as Apple?? Nothing would get onto a Win System without MS approving it??
And Microsoft is aware of these issues, as they are writing
out third party drivers (Ring0). They are working on improving
the walls of their cardboard fortress in Ring0.
On Sat, 14 Jun 2025 05:02:11 -0400, Paul wrote:
And Microsoft is aware of these issues, as they are writing
out third party drivers (Ring0). They are working on improving
the walls of their cardboard fortress in Ring0.
The Linux world solves the problem by submitting the drivers to open-
source peer review.
On Sat, 6/14/2025 7:22 PM, Lawrence D'Oliveiro wrote:
Yes, the NVidia binary blob :-) <snicker>
On Sat, 14 Jun 2025 05:02:11 -0400, Paul wrote:
And Microsoft is aware of these issues, as they are writing
out third party drivers (Ring0). They are working on improving
the walls of their cardboard fortress in Ring0.
The Linux world solves the problem by submitting the drivers to open-
source peer review.
That means, roughly speaking, the NVidia binary blob got
just as much review on Linux as it did on Windows.
On Sat, 6/14/2025 7:22 PM, Lawrence D'Oliveiro wrote:
On Sat, 14 Jun 2025 05:02:11 -0400, Paul wrote:Yes, the NVidia binary blob :-) <snicker>
And Microsoft is aware of these issues, as they are writing out third
party drivers (Ring0). They are working on improving the walls of
their cardboard fortress in Ring0.
The Linux world solves the problem by submitting the drivers to open-
source peer review.
That means, roughly speaking, the NVidia binary blob got just as much
review on Linux as it did on Windows.
On Sat, 14 Jun 2025 23:15:21 -0400, Paul <[email protected]d> wrote in <102ldsb$m8mk$[email protected]>:
On Sat, 6/14/2025 7:22 PM, Lawrence D'Oliveiro wrote:
On Sat, 14 Jun 2025 05:02:11 -0400, Paul wrote:Yes, the NVidia binary blob :-) <snicker>
And Microsoft is aware of these issues, as they are writing out third
party drivers (Ring0). They are working on improving the walls of
their cardboard fortress in Ring0.
The Linux world solves the problem by submitting the drivers to open-
source peer review.
Old news -- the newer branch of NVIDIA drivers is MIT/GPL
licensed.
That means, roughly speaking, the NVidia binary blob got just as much
review on Linux as it did on Windows.
Used to be that way. Not any more.
https://github.com/NVIDIA/open-gpu-kernel-modules
In fact, with some of their newer GPU cards, you _must_
use the MIT/GPL branch.
On Fri, 6/13/2025 4:50 PM, candycanearter07 wrote:
Paul <[email protected]d> wrote at 00:27 this Friday (GMT):
On Thu, 6/12/2025 11:10 AM, candycanearter07 wrote:
Lawrence D'Oliveiro <[email protected]d> wrote at 23:35 this Tuesday (GMT): >>>>> On Tue, 10 Jun 2025 12:11:56 -0400, Oscar wrote:
Can someone just give me the best way to get rid of it safely?
You can’t. It’s needed for the Windows security mechanism to work. >>>>
That seems like a really dumb and insecure bandaid fix.
I'm surprised they didn't set the Hidden attribute on it.
Paul
They DIDN'T?? That seems like a disaster waiting to happen.
The purpose of hiding it, is so the ordinary users do not remove it.
It has nothing to do with protecting a thing from an exploit.
This is why I like the protections on WinRE.wim file (emergency
boot OS container). It's got all sorts of Hidden and System
attributes set on it. All this does, is annoy the fuck out
of people like me, working on fixing it. And it does nothing
at all to stop a Black Hat.
But still, the Hidden is to hide cosmetic issues, such
as if you are using this trick (temporarily) as a fix.
As an example, the Process Monitor you can download from
Microsoft, it has a boot trace option, where you can trace
execution (ETW events) from T=0. What people don't know
(because they can't see it), is a "procmon23.sys" or similar,
is added to System32, and that module is loaded at boot time.
Since the Hidden bit is set on it, people can't see it, and
the program does not clean up after itself and remove the
file again. When the API changes, the version is bumped
to "procmon24.sys".
How can I spot those ? Using nfi.exe , for NTFS listing.
That parses the $MFT (Master File Table) and avoids a lot of issues.
Let's see if I have a procmon passenger on board.
.\nfi.exe C: > D:\nfi-c-out.txt
File 8170
\Windows\System32\drivers\PROCMON24.SYS <=== passenger!
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$FILE_NAME (resident)
$DATA (nonresident)
logical sectors 287064-287223 (0x46158-0x461f7)
logical sectors 292472-292479 (0x47678-0x4767f)
*******
Command Prompt:
cd /d C:\Windows\System32\drivers\
dir /ah PROCMON2*Volume in drive C is W11HOME
Volume Serial Number is FA6E-E123
Directory of C:\Windows\System32\drivers
Sat, 05/31/2025 1:23 PM 82,344 PROCMON24.SYS
Paul
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 715 |
| Nodes: | 16 (3 / 13) |
| Uptime: | 46:34:54 |
| Calls: | 12,112 |
| Calls today: | 3 |
| Files: | 15,010 |
| Messages: | 6,518,487 |
