kansasmann Thank you for the report.
I will not have the time to investigate this case further this week.
Could you try using the WAR provided in JENKINS-56114 ? As they were also using Windows Server, that could the same root cause.
In addition, did you try with the escape hatch: java.exe -Dhudson.model.DirectoryBrowserSupport.allowSymlinkEscape=true -jar jenkins.war ? (in both your current version and in the WAR provided in the other ticket)
Then could you give me more information about your configuration, like are you using Docker inside your Windows Server, or just running java -jar ..., or using the service?
If you can provide also additional information from the log of the build, that could be useful. Also, what is the content of the userContent in your instance (in terms of type, not the real files, but to know if there are symlinks, what are their targets, or just image files?)
Thank you in advance for your next answer that will help me helping you 
wfollonier FYI