Microsoft pulls a 30-year-old Windows tool that hackers loved
WMIC, a command-line utility abused by ransomware crews to wipe backups and disable antivirus, is gone from fresh installs of Windows 11 24H2 and 25H2.
Key points
- Microsoft has removed the Windows Management Instrumentation Command-line tool, known as WMIC, from new installs of Windows 11 versions 24H2 and 25H2.
- The tool is no longer available as an optional add-on (a Feature on Demand) as of the change announced this week.
- WMIC was deprecated back in 2016 on Windows Server 2012 and in 2021 on Windows 10 21H1, so this removal has been telegraphed for years.
- Ransomware gangs routinely used WMIC to delete Windows backup snapshots, uninstall antivirus, and add exclusions to Microsoft Defender.
- Windows Management Instrumentation itself, the underlying system WMIC talked to, is not going anywhere. Only the old command-line front end is being cut.
Microsoft has finally pulled the plug on WMIC, a decades-old command-line tool that criminals used to disable defences on Windows machines before locking them up for ransom.
The change landed this week in Windows 11 versions 24H2 and 25H2, plus current beta builds. First reported by BleepingComputer, the removal means fresh installs no longer ship the utility, and it can no longer be added back as an optional Windows component.
What exactly did Microsoft remove?
Microsoft removed WMIC, short for Windows Management Instrumentation Command-line. It is a built-in text-based tool that lets an administrator ask Windows questions and change settings by typing commands, for example "list the antivirus products installed on this PC."
The underlying plumbing it spoke to, called Windows Management Instrumentation (WMI), stays put. Only the old typing-based front end is gone. Modern equivalents such as PowerShell, a newer scripting tool built into Windows, do the same jobs and are what Microsoft points administrators toward instead.
WMIC was deprecated (marked as "do not rely on this any more") in Windows Server 2012 back in 2016, then in Windows 10 21H1 in 2021. In 2022 it became a Feature on Demand, meaning it was not installed by default but could be added. In January 2024 Microsoft said it would be removed altogether. This week it was.
Why did the hackers like it so much?
WMIC was a favourite because it was already there, signed by Microsoft, and trusted by security software. Attackers did not need to smuggle in their own tools. They could just use the one Windows shipped with.
Security researchers call this pattern a LOLBIN, short for "living off the land binary." The idea is simple: a burglar who uses the homeowner's own kitchen knife is harder to spot than one who brings a crowbar.
In practice, that looked like this:
| Attack step | What WMIC was used for |
|---|---|
| Preparing a ransomware hit | Deleting Shadow Volume Copies, the backup snapshots Windows keeps, so victims cannot restore files |
| Scouting the machine | Listing installed antivirus and security products |
| Disabling defences | Uninstalling antivirus or adding folders to Microsoft Defender's exclusion list so malware runs unnoticed |
Strip WMIC out and a lot of off-the-shelf ransomware scripts simply break. Attackers can still do these things through PowerShell or the WMI programming interfaces, but they have to write new tooling, and defenders have fewer familiar commands to watch for.
Should home users and businesses do anything?
Home users do not need to lift a finger. If you install Windows 11 24H2 or 25H2 fresh, WMIC will not be there, and you will not miss it.
Businesses are a different story. Any old script, scheduled task, or software installer that still calls wmic.exe will fail on a clean install of the newer Windows versions. IT teams should search their estate for those calls now and rewrite them in PowerShell or a supported programming interface before rolling out the new builds.
One caveat worth flagging: machines upgraded from earlier Windows 11 versions may still have WMIC present until the change catches up with them. Do not assume it is gone just because the release notes say so.
This is a quiet win for defenders. It closes a door that has been propped open since the 1990s.
