Microsoft will remove the Windows Management Instrumentation Command-line (WMIC) utility with the release of Windows 11 version 25H2 and later. The tool will no longer be included by default in these versions.
WMIC is a legacy command-line interface for interacting with the Windows Management Instrumentation (WMI) subsystem. Administrators have been advised to transition to PowerShell for WMI-related tasks, including scripting and system queries.
Microsoft recommends using PowerShell, the WMI COM API, .NET libraries, or other supported scripting methods as replacements for WMIC functionality. Organizations are urged to update internal documentation and operational procedures accordingly.
The underlying WMI service remains active and unchanged. Only the WMIC command-line wrapper is being discontinued.
WMIC was first deprecated in Windows Server 2012 in 2016 and in Windows 10 21H1 in 2021. Starting with Windows 11 22H2 in 2022, it became a Feature on Demand. In January 2024, Microsoft confirmed its complete removal after prior deactivation by default.
Removal of WMIC reduces the attack surface by eliminating a commonly abused component known as a LOLBIN: Legitimate, signed binaries exploited by threat actors. Malware has historically used WMIC to delete Shadow Volume Copies, disable antivirus software, and add exclusions to Microsoft Defender to evade detection.
Additional guidance for administrators transitioning from WMIC is available in Microsoft’s published support documentation.
Support us
Winaero greatly relies on your support. You can help the site keep bringing you interesting and useful content and software by using these options:
