Microsoft has started the final removal of the legacy command-line utility WMIC from Windows 11. The tool is already missing from new installations of versions 24H2 and 25H2, is no longer offered as an optional component, and has disappeared from the latest beta builds of the operating system.
WMIC allowed administrators to manage Windows Management Instrumentation through text commands, retrieving information about hardware, processes, services, and security software while also executing administrative operations. The core WMI technology itself remains intact; only the old command-line interface has been retired.
Microsoft has been preparing this deprecation for years. WMIC was first marked as deprecated in Windows Server 2012, then again in Windows 10 21H1. In Windows 11 22H2 it was moved to optional components, later disabled by default, and is now being fully removed.
The decision stems not only from the tool's age but also from its widespread abuse as a LOLBIN. Attackers have long used the signed Microsoft binary instead of deploying suspicious executables. Ransomware groups have employed WMIC to delete shadow copies, preventing victims from restoring encrypted data. Other threat actors have used it to discover installed security products, disable them, or add exclusions to Microsoft Defender.
Administrators are advised to transition to PowerShell, the COM API for WMI, .NET libraries, and contemporary scripting languages. Existing scripts that rely on WMIC commands will need to be rewritten after the update, or automation workflows will stop functioning.
The change reduces the number of built-in tools available to attackers but also removes a familiar utility from the toolkit of system administrators.
