Simon Zerafa<p>If you have managed to delete your C:\inetpub folder following the recent <a href="https://infosec.exchange/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Windows</span></a> security <a href="https://infosec.exchange/tags/patch" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>patch</span></a> for <a href="https://infosec.exchange/tags/cve202521204" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cve202521204</span></a> then you can re-create it using the following PowerShell script:</p><p><a href="https://github.com/mmotti/Reset-inetpub" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">github.com/mmotti/Reset-inetpub</span><span class="invisible"></span></a></p><p>This script recreates this empty folder with the correct TrustedInstaller and SYSTEM privilages.</p><p>It does nothing to prevent the creation of HardLinks to this folder of course.</p><p>You could remove the SeCreateSymbolicLinkPrivilege (via secpol.msc for example) from a user account to prohibit creation of SymLinks but you would need to check in a test envoiroment to see what effects might have that have and what might break 🤔🤷♂️</p>