Microsoft has completed the WMIC removal in Windows 11, pulling the legacy Windows Management Instrumentation Command-line tool from Windows 11 24H2 and 25H2 as well as from beta builds released this week. It is a tidy end to a years-long deprecation process, and one that closes off a toolkit that ransomware operators and other threat actors have leaned on heavily.
A Slow Goodbye: The WMIC Deprecation Timeline
WMIC has been on borrowed time for a while. Microsoft deprecated it in Windows Server 2012 (in 2016) and in Windows 10 21H1 (in 2021). With Windows 11 22H2 in 2022, the tool was converted into a Feature on Demand (FoD) rather than a standard built-in component, giving administrators a way to keep it if needed while signalling its eventual exit. In January 2024, Microsoft announced it would be removed altogether, with disabling by default coming first.
The company confirmed in a Monday notice that ‘Windows Management Instrumentation Command-line (WMIC) has been removed in this release. This change is part of the ongoing deprecation and removal of WMIC from Windows.’ Three days earlier, on the Friday before, Microsoft had already disclosed that the tool is ‘already removed by default in new installations of Windows 11, versions 24H2 and 25H2, and is no longer available as a Feature on Demand (FoD).’
One wrinkle worth knowing for IT teams managing upgrade paths rather than clean installs: according to Microsoft Support, when upgrading to Windows 11 version 25H2, WMIC is removed but can still be added back as a Feature on Demand. That opt-back-in route does not apply to fresh installations, where the tool is simply gone. Administrators who depend on WMIC-based scripts will need to plan accordingly, because the default posture on any new machine is now WMIC-free.
WMI Stays, WMIC Goes
It is worth being precise about what is actually leaving. The removal affects only the WMIC command-line wrapper. Windows Management Instrumentation (WMI) itself, the underlying system that WMIC was a front-end for, remains fully intact. Organisations whose tools query WMI directly through its COM API, .NET libraries, or scripting interfaces will not see any disruption.
For those who did rely on WMIC commands, Microsoft’s guidance document recommends migrating to PowerShell and other modern tooling. Microsoft’s developer documentation covers the relevant WMI interfaces in detail for teams making that transition.
Why the Security Community Has Been Waiting for This
WMIC’s classification as a LOLBIN (living-off-the-land binary) tells you most of what you need to know about its reputation in security circles. LOLBINs are legitimate, Microsoft-signed executables that threat actors repurpose during attacks precisely because they blend in with normal system activity and often slip past defences tuned to look for unsigned or external code.
WMIC was a particularly well-worn entry in that category. Ransomware encryptors have routinely used WMIC commands to delete Shadow Volume Copies, stripping victims of their ability to recover encrypted files without paying. Separately, threat actors have used the tool to query installed security solutions and antivirus software, and in some cases to uninstall them outright. Malware has also been observed using WMIC to add exclusions to Microsoft Defender, carving out space to operate undetected on compromised machines.
The breadth of those abuse cases is what made WMIC’s eventual removal genuinely consequential from a defensive standpoint. Attackers who have scripted WMIC calls into their toolchains will need to find alternative methods, and while alternatives exist, removing a convenient built-in option does raise the cost and complexity of an attack.
None of that means WMI-based attack techniques disappear overnight. Sophisticated actors have always had routes that do not depend on WMIC specifically. But for the large volume of commodity ransomware and opportunistic intrusions that lean on ready-made, off-the-shelf scripts, losing WMIC as a reliable built-in lever is a genuine obstacle. Microsoft’s own guidance document notes that further support for IT administrators navigating the change is available via the Microsoft Support page linked above, including specific recommendations for migrating existing workflows to PowerShell.
