diff --git a/cmd/kubeadm/app/phases/copycerts/copycerts_test.go b/cmd/kubeadm/app/phases/copycerts/copycerts_test.go
index 6bc5b384243..305a4441c81 100644
--- a/cmd/kubeadm/app/phases/copycerts/copycerts_test.go
+++ b/cmd/kubeadm/app/phases/copycerts/copycerts_test.go
@@ -22,6 +22,7 @@ import (
 	"os"
 	"path"
 	"regexp"
+	goruntime "runtime"
 	"testing"
 
 	"github.com/lithammer/dedent"
@@ -241,20 +242,26 @@ func TestDownloadCerts(t *testing.T) {
 		// Check that the written files are either certificates or keys, and that they have
 		// the expected permissions
 		if _, err := keyutil.ParsePrivateKeyPEM(diskCertData); err == nil {
-			if stat, err := os.Stat(certPath); err == nil {
-				if stat.Mode() != keyFileMode {
-					t.Errorf("key %q should have mode %#o, has %#o", certName, keyFileMode, stat.Mode())
+			// File permissions are set differently on Windows, which does not match the expectation below.
+			if goruntime.GOOS != "windows" {
+				if stat, err := os.Stat(certPath); err == nil {
+					if stat.Mode() != keyFileMode {
+						t.Errorf("key %q should have mode %#o, has %#o", certName, keyFileMode, stat.Mode())
+					}
+				} else {
+					t.Errorf("could not stat key %q: %v", certName, err)
 				}
-			} else {
-				t.Errorf("could not stat key %q: %v", certName, err)
 			}
 		} else if _, err := keyutil.ParsePublicKeysPEM(diskCertData); err == nil {
-			if stat, err := os.Stat(certPath); err == nil {
-				if stat.Mode() != certFileMode {
-					t.Errorf("cert %q should have mode %#o, has %#o", certName, certFileMode, stat.Mode())
+			// File permissions are set differently on Windows, which does not match the expectation below.
+			if goruntime.GOOS != "windows" {
+				if stat, err := os.Stat(certPath); err == nil {
+					if stat.Mode() != certFileMode {
+						t.Errorf("cert %q should have mode %#o, has %#o", certName, certFileMode, stat.Mode())
+					}
+				} else {
+					t.Errorf("could not stat cert %q: %v", certName, err)
 				}
-			} else {
-				t.Errorf("could not stat cert %q: %v", certName, err)
 			}
 		} else {
 			t.Errorf("secret %q was not identified as a cert or as a key", certName)
diff --git a/cmd/kubeadm/app/util/copy.go b/cmd/kubeadm/app/util/copy_unix.go
similarity index 94%
rename from cmd/kubeadm/app/util/copy.go
rename to cmd/kubeadm/app/util/copy_unix.go
index 5e9c9ef0bdb..e2601bc94e8 100644
--- a/cmd/kubeadm/app/util/copy.go
+++ b/cmd/kubeadm/app/util/copy_unix.go
@@ -1,3 +1,6 @@
+//go:build !windows
+// +build !windows
+
 /*
 Copyright 2017 The Kubernetes Authors.
 
diff --git a/cmd/kubeadm/app/util/copy_windows.go b/cmd/kubeadm/app/util/copy_windows.go
new file mode 100644
index 00000000000..e689e200432
--- /dev/null
+++ b/cmd/kubeadm/app/util/copy_windows.go
@@ -0,0 +1,32 @@
+//go:build windows
+// +build windows
+
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import (
+	"os/exec"
+)
+
+// CopyDir copies the content of a folder
+func CopyDir(src string, dst string) error {
+	// /E Copies directories and subdirectories, including empty ones.
+	// /H Copies hidden and system files also.
+	cmd := exec.Command("xcopy", "/E", "/H", src, dst)
+	return cmd.Run()
+}
diff --git a/pkg/volume/util/subpath/subpath_windows.go b/pkg/volume/util/subpath/subpath_windows.go
index c8a3a6b7f56..7d40ce590fe 100644
--- a/pkg/volume/util/subpath/subpath_windows.go
+++ b/pkg/volume/util/subpath/subpath_windows.go
@@ -114,7 +114,8 @@ func evalSymlink(path string) (string, error) {
 		}
 	}
 	// This command will give the target path of a given symlink
-	cmd := fmt.Sprintf("(Get-Item -LiteralPath %q).Target", upperpath)
+	// The -Force parameter will allow Get-Item to also evaluate hidden folders, like AppData.
+	cmd := fmt.Sprintf("(Get-Item -Force -LiteralPath %q).Target", upperpath)
 	output, err := exec.Command("powershell", "/c", cmd).CombinedOutput()
 	if err != nil {
 		return "", err