limited user creates c:\inetpub before updates installed

Notices where this attachment appears

1. Embed this notice
   Will Dormann (wdormann@infosec.exchange)'s status on Friday, 11-Apr-2025 03:35:47 JST Will Dormann

   @GossiTheDog
   Specifically, I've seen all April updates install even when C:\inetpub exists ahead of time.

   I should have known better than to attribute the correlation of C:\inetpub in a VM before updates to the causation of a failed update.

   What happens with C:\inetpub is tough to see, as it either happens before the Procmon boot driver loads, or Procmon is otherwise foiled by the updates occurring. But either way, there's a bit of a blind spot between pre-reboot C:\inetpub not being there and it being there post-reboot. A Procmon boot log sees nothing. 😕