Microsoft trims Windows 11 right-click menu and retires a tool long abused by hackers

Key points

• Microsoft is testing a faster File Explorer and a slimmer right-click menu in Windows 11 Insider builds released this week.
• The new context menu adds a Settings shortcut so users can choose which items appear.
• Microsoft is removing the Windows Management Instrumentation Command-line tool, known as WMIC, from Windows 11 versions 24H2 and 25H2.
• WMIC has been tracked for years as a living-off-the-land binary, meaning a legitimate Windows tool that attackers quietly use to run commands and blend in.
• The File Explorer work follows earlier speed changes in April and a background preloading option added in November.

Microsoft is testing two changes in Windows 11 that most people will notice the moment they right-click a file. One is a faster File Explorer, the app you use to browse folders. The other is a shorter, tidier context menu, the small list of options that pops up when you right-click.

Both landed this week in preview builds for Windows Insiders, the volunteers who test early versions of Windows.

What actually changed in File Explorer?

Microsoft says the focus is speed, reliability and small annoyances users have reported. Renaming a file no longer gets interrupted by cloud sync running in the background. Changes that only affect letter case, say turning "Report.docx" into "REPORT.docx", now show up straight away instead of lagging.

The right-click menu itself has been redesigned. Common actions stay at the top. Less-used items are tucked away. A new "Customize menu" shortcut at the bottom drops you into Settings, where you can decide what appears and what does not.

"The new design reduces top-level clutter, keeps commonly used actions easy to access, and introduces a new Settings experience that gives you more control over what appears in the menu," Microsoft said in a blog post first covered by BleepingComputer.

Why is Microsoft removing WMIC?

Because criminals have been using it against Windows users for years. WMIC, short for Windows Management Instrumentation Command-line, is a built-in administrator tool that can run commands, query the system and reach across a network. It was deprecated in 2021, and Microsoft is now pulling it from Windows 11 24H2 and 25H2, as well as this week's beta builds.

In threat intelligence circles, WMIC is a textbook LOLBIN, a living-off-the-land binary. That is jargon for a normal, signed Windows program that hackers use for malicious work, because it looks like routine admin activity and rarely trips alarms.

Ransomware crews tracked as Conti and Black Basta by multiple vendors, as well as espionage clusters overlapping with what CrowdStrike calls Wizard Spider and what Mandiant groups under FIN7, have all been documented running WMIC to move sideways through networks, list processes and disable defences. Removing the binary does not stop the technique outright, since attackers can call the underlying WMI system directly through PowerShell. It does raise the cost, which is the point.

Capability is not the same as intent, and plenty of admins still have legitimate scripts that call WMIC. Microsoft's guidance is to move those to PowerShell before the tool disappears from their machines.

What changed and when

Should ordinary users do anything?

Not really, unless you are on the Insider programme. The File Explorer changes will arrive in a normal Windows update when Microsoft is ready. If you run scripts at home or at work that call wmic.exe, now is the time to rewrite them in PowerShell. Everyone else can ignore that part.

The wider lesson is quieter. Windows is slowly shedding old tools that attackers have grown comfortable with. That is a good thing, even if it makes a few IT jobs briefly harder.