Microsoft Begins Stripping WMIC From Windows 11 to Cut Off Attackers
Microsoft has started removing the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2, 25H2, and the latest beta builds. WMIC has been a staple for IT admins scripting system queries and management tasks since the early 2000s, but it's also become a favorite "living-off-the-land" binary for attackers who use built-in Windows tools to avoid detection.
Security researchers have long flagged WMIC as a common vector in ransomware and post-exploitation toolkits, since it lets attackers query systems, move laterally, and execute commands without dropping obvious malicious files. Microsoft first signaled WMIC's deprecation years ago, pushing admins toward PowerShell's CIM/WMI cmdlets instead, and this removal marks the next step in actually pulling the tool from the OS.
Admins relying on legacy scripts or third-party tools that call WMIC directly should test their environments now, since those tools will break once the binary disappears entirely from mainstream Windows 11 releases.