Microsoft has started removing the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11, eliminating a long-abused living-off-the-land binary (LOLBIN) that threat actors have relied on for years to carry out post-exploitation tasks on compromised systems.

The company confirmed that WMIC is now removed from Windows 11 24H2 and 25H2, as well as from beta builds released this week. According to Microsoft, WMIC is already removed by default in new installations of 24H2 and 25H2 and is no longer available as a Feature on Demand (FoD).

WMIC is a legacy utility that lets administrators interact with the Windows Management Instrumentation (WMI) subsystem via text commands. Its removal does not affect WMI itself, which remains fully functional. Only the standalone WMIC executable is being phased out.

A years-long deprecation process

This removal is the culmination of a process Microsoft announced in September, when it said WMIC would be pulled after devices upgraded to Windows 11 25H2. The tool was first deprecated in Windows Server 2012 back in 2016 and in Windows 10 21H1 in 2021. Microsoft converted WMIC into a Feature on Demand starting with Windows 11 22H2 in 2022, then announced in January 2024 that it would eventually be removed entirely after being disabled by default.

Microsoft has published guidance for IT administrators still relying on WMIC, recommending a shift to PowerShell, WMI’s COM API, .NET libraries, or other scripting languages to replicate previous WMIC functionality.

Why attackers loved WMIC

WMIC has long been flagged as a LOLBIN, a built-in, Microsoft-signed binary that gives attackers a way to blend malicious activity into normal system operations. Security researchers have repeatedly observed ransomware operators using WMIC to delete Shadow Volume Copies, preventing victims from recovering encrypted files without paying a ransom.

Other threat actors have used the tool to enumerate installed antivirus and security products and subsequently uninstall them, or to add exclusions to Microsoft Defender that help malware evade detection.

By removing WMIC outright rather than simply disabling it, Microsoft aims to shut down these attack paths for good. Organizations that depend on scripts or tooling built around WMIC should test their environments and migrate to the recommended alternatives before broader rollout of affected Windows 11 versions.