Microsoft removes WMIC tool from Windows 11

As outlined in Bleeping Computer, Microsoft has officially removed the Windows Management Instrumentation Command-line (WMIC) tool from recent Windows 11 builds, including versions 24H2 and 25H2, as well as beta releases. This action is part of a phased deprecation process that began years ago.

WMIC, a legacy command-line utility for interacting with Windows Management Instrumentation (WMI), has been progressively phased out. Microsoft previously deprecated it in Windows Server 2012 and Windows 10, later making it a Feature on Demand in Windows 11 22H2 before announcing its complete removal. The tool's removal from new installations and as a Feature on Demand aims to enhance operating system security.

WMIC has been frequently abused by threat actors as a LOLBIN (living-off-the-land binary). Malware, including ransomware, has utilized WMIC to delete Shadow Volume Copies, query and uninstall security software, and add exclusions to Microsoft Defender, thereby evading detection. While WMIC is gone, the underlying WMI system remains unaffected. Microsoft recommends IT administrators transition to modern alternatives like PowerShell, WMI's COM API, or .NET libraries for management tasks.

Source: Bleeping Computer