Microsoft Removes WMIC From Windows 11 24H2 and 25H2, Closing Out a 25-Year-Old Tool Abused as a LOLBIN

Overview

Microsoft has removed the Windows Management Instrumentation Command-line (WMIC) utility from current Windows 11 builds, ending the run of a command-line tool that shipped with Windows for roughly a quarter-century and was increasingly abused by attackers. According to BleepingComputer, Microsoft removed WMIC from Windows 11 24H2 and 25H2, as well as from Windows 11 beta builds released this week.

What We Know

WMIC is, in BleepingComputer’s words, “a legacy built-in Windows command-line utility that helps interact with the Windows Management Instrumentation (WMI) system using text commands.” The removal reached Windows 11 in two steps documented directly in Microsoft’s own release notes. Microsoft’s release notes for Release Preview Builds 26100.9267 and 26200.9267 (KB5120998), covering Windows 11 versions 24H2 and 25H2 and dated 14 August 2026, state: “Starting in August 2026, Windows 11, versions 24H2 and 25H2 no longer include the Windows Management Instrumentation Command-line (WMIC) utility. WMIC is already removed by default in new installations of Windows 11, versions 24H2 and 25H2, and is no longer available as a Feature on Demand (FoD). This change affects only the WMIC utility. Windows Management Instrumentation (WMI) remains supported.”

Three days later, Microsoft’s release notes for Beta Preview Build 26220.9202, dated 17 August 2026, confirmed the tool was gone from that build too: “Windows Management Instrumentation Command-line (WMIC) has been removed in this release. This change is part of the ongoing deprecation and removal of WMIC from Windows.” According to heise online, new builds in the Beta and Experimental Insider channels for Windows 11 26H2 and 26H1 carry the same removal.

The change did not arrive without warning. As BleepingComputer recounts, “Microsoft deprecated WMIC in Windows Server 2012 (in 2016) and Windows 10 21H1 (in 2021), and it converted it into a Feature on Demand (FoD) starting with Windows 11 22H2 (in 2022), and announced in January 2024 that it would be removed altogether after first disabling it by default.” Microsoft’s own deprecated-features documentation corroborates the 21H1 date, listing the WMIC utility’s “Original announcement” as “Windows 10, version 21H1,” with a “Courtesy reminder” issued in September 2025.

Microsoft frames the removal chiefly as a security measure. Per BleepingComputer, “the tool has long been considered a LOLBIN (living-off-the-land binary), a built-in Microsoft-signed executable that threat actors have abused for a wide range of malicious activities during attacks targeting Windows devices.” The article details specific abuse patterns: “ransomware encryptors commonly use the WMIC command to delete Shadow Volume Copies to ensure that the victims can’t recover encrypted data,” while “other threat actors have also used WMIC to query for the list of installed security solutions and antivirus software and uninstall them,” and “malware has also been observed using WMIC to add exclusions to Microsoft Defender, which helps evade detection on compromised systems.”

Only the command-line front end disappears. Both BleepingComputer and Microsoft’s own builds note that “these changes apply only to the legacy WMIC component, as Windows Management Instrumentation (WMI) itself remains unaffected.” Microsoft’s support guidance directs administrators to PowerShell as the primary replacement, offering a direct migration example: replacing the WMIC query “wmic path win32_process get Name” with the PowerShell command “Get-CimInstance Win32_Process | Select-Object Name.” For batch files or scripts, Microsoft recommends rewriting them “using PowerShell cmdlets (such as Get-CimInstance, Get-WmiObject, Invoke-CimMethod, and so forth).” For applications and advanced scripts, the same guidance points to “WMI’s COM API or .NET libraries (like System.Management in C#) to execute WMI queries directly in code” — a point BleepingComputer also flags, recommending “PowerShell and other modern tools (e.g., WMI’s COM API, .NET libraries, or scripting languages) for tasks previously done with WMIC.”

What We Don’t Know

Microsoft’s release notes describe the removal as reaching “new installations” and Insider Preview builds first; the articles reviewed do not specify an exact date on which the change reaches the general-availability Windows Update channel for all existing 24H2 and 25H2 installations outside the Insider program. Neither source reviewed here details how many organizations still have scripts, scheduled tasks, or deployment tooling that call wmic.exe directly, so the practical scope of disruption for IT administrators is not yet quantified in the coverage.

Analysis

WMIC’s removal fits a broader pattern in recent Windows security hardening: retiring legacy, Microsoft-signed utilities that predate modern telemetry and detection tooling but remain fully trusted by the OS, making them attractive to attackers precisely because defenders are less likely to flag their use as anomalous. That a single command-line tool could simultaneously serve as a convenient sysadmin utility and a favored ransomware technique for over two decades illustrates the tension legacy CLI tooling creates for platform security teams — and why Microsoft’s response was not merely to patch or restrict WMIC, but to eliminate the command-line front end outright while preserving the underlying WMI plumbing for the PowerShell- and API-based tooling that replaced it in day-to-day administrative use.