Microsoft Pulls WMIC from Windows 11 — a Tool Beloved by Hackers

Microsoft has announced that it is removing the Windows Management Instrumentation Command-line (WMIC) utility from Windows 11 versions 24H2 and 25H2, as well as from the beta builds released this week. WMIC is a built-in tool that let you interact with the Windows Management Instrumentation (WMI) system through text commands.

The move marks the finale of a long story of phasing the utility out. The company announced its plans in September, promising to remove WMIC after the upgrade to Windows 11 25H2 and later versions. Formally, though, the road to retirement began much earlier: the tool was declared deprecated back in Windows Server 2012 (in 2016) and in Windows 10 21H1 (in 2021), it became a Feature on Demand as of Windows 11 22H2, and in January 2024 its final removal was announced, with it being disabled by default beforehand.

On Monday, Microsoft confirmed that WMIC has been “removed in this release,” and three days earlier, on Friday, it clarified that the tool is “already removed by default on new installs of Windows 11 versions 24H2 and 25H2 and is no longer available as a Feature on Demand.”

An important caveat: the changes affect only the deprecated WMIC component — the WMI subsystem itself stays in place. For administrators who relied on the utility, Microsoft recommends switching to PowerShell and other modern tools: the WMI COM API, .NET libraries, or scripting languages.

Why the tool was slated for removal

The reason isn't a fashion for minimalism, but security. WMIC has long been on the list of so-called LOLBINs (living-off-the-land binaries) — legitimate, Microsoft-signed executables that attackers use in their operations so they don't have to bring along their own malicious code and don't stand out against the system's normal activity.

The list of abuses is impressive. Ransomware used WMIC to delete Shadow Volume Copies, robbing victims of any chance to recover their encrypted data. Other attackers used it to find out which antivirus and security solutions were installed on a machine and then remove them. Finally, WMIC was used to add exclusions to Microsoft Defender, helping malware slip past detection.

By removing the utility, Microsoft hopes to devalue in one stroke a whole arsenal of techniques that will simply stop working afterward.

Source: Bleeping Computer