Microsoft has initiated the removal of the Windows Management Instrumentation Command-line (WMIC) tool from recent versions of Windows 11, including builds 24H2 and 25H2, as well as current beta builds. This action follows a series of deprecation announcements and changes that began in 2016.
The WMIC utility, a legacy component for interacting with the Windows Management Instrumentation (WMI) system via text commands, has been identified as a "living-off-the-land binary" (LOLBIN). This designation refers to legitimate, built-in Microsoft-signed executables that threat actors frequently abuse for malicious activities on Windows systems.
Microsoft first deprecated WMIC in Windows Server 2012 in 2016 and later in Windows 10 21H1 in 2021. In 2022, with Windows 11 22H2, it was converted into a Feature on Demand (FoD). The company announced in January 2024 its intention for complete removal, following an initial phase of disabling it by default.
The current removal efforts were confirmed by Microsoft on a Monday, stating that WMIC "has been removed in this release" as part of its ongoing deprecation process. Three days prior, on a Friday, the company also noted that the tool is "already removed by default in new installations of Windows 11, versions 24H2 and 25H2, and is no longer available as a Feature on Demand (FoD)."
This change specifically targets the legacy WMIC command-line component; the underlying Windows Management Instrumentation (WMI) system itself remains functional and unaffected. For IT administrators who previously relied on WMIC, Microsoft recommends transitioning to modern alternatives such as PowerShell, WMI's COM API, .NET libraries, or various scripting languages.
The decision to remove WMIC is a strategic move to enhance the operating system's security posture. Its removal aims to neutralize a wide array of malware and attack techniques that have historically exploited the tool.
For example, ransomware encryptors have commonly leveraged WMIC commands to delete Shadow Volume Copies, a tactic designed to prevent victims from recovering encrypted data. Other malicious actors have used WMIC to enumerate installed security solutions and antivirus software, often with the intent to uninstall them. Furthermore, malware has been observed employing WMIC to add exclusions to Microsoft Defender, thereby facilitating evasion of detection on compromised systems.
