● Covered by 1 source · 1 reportMedium impact1 neutral
Microsoft removes WMIC tool from Windows 11 24H2 and 25H2 to enhance security
Key points
- WMIC removed from Windows 11 24H2, 25H2, and beta builds.
- WMIC was a legacy command-line utility for WMI interaction.
- Removal targets malware and attack tactics using WMIC.
- WMI itself remains unaffected; PowerShell is recommended alternative.
WMIC Removal from Windows 11
Microsoft has begun removing the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11. This change applies to Windows 11 versions 24H2 and 25H2, as well as recent beta builds. The company previously announced this deprecation process in September.
Background of WMIC Deprecation
WMIC is a legacy built-in Windows command-line utility used for interacting with the Windows Management Instrumentation (WMI) system. Microsoft deprecated WMIC in Windows Server 2012 and Windows 10 21H1. It was converted into a Feature on Demand (FoD) starting with Windows 11 22H2, and in January 2024, Microsoft announced its complete removal after initially disabling it by default. The tool is now removed by default in new installations of Windows 11, versions 24H2 and 25H2, and is no longer available as an FoD.
Security Implications
The removal of WMIC is intended to enhance the overall security of the operating system. WMIC has been identified as a "living-off-the-land binary" (LOLBIN), meaning it is a legitimate, built-in Microsoft-signed executable that threat actors have abused for malicious activities. These activities include deleting Shadow Volume Copies to prevent data recovery in ransomware attacks, querying for installed security solutions, and adding exclusions to Microsoft Defender to evade detection.
Alternatives for IT Administrators
While WMIC is being removed, the underlying Windows Management Instrumentation (WMI) system remains unaffected. Microsoft recommends that IT administrators who previously relied on WMIC transition to modern tools such as PowerShell, WMI's COM API, .NET libraries, or other scripting languages for tasks previously performed with WMIC. Guidance for this transition is available in Microsoft's support documentation.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Microsoft has removed the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2, 25H2, and beta builds. This removal aims to improve operating system security by eliminating a tool frequently abused by malware and threat actors.