Windows 11 Drops WMIC, a Longtime Malware Favorite

Attack surface reduction is the least glamorous security work there is, and it is often the most effective. Starting in August 2026, Windows 11 versions 24H2 and 25H2 no longer include WMIC — the Windows Management Instrumentation Command-line utility — completing a deprecation that Microsoft began in 2016. For defenders, this closes one of the most reliably abused living-off-the-land binaries in the Windows ecosystem.

• WMIC is removed by default from Windows 11 24H2 and 25H2 and is no longer available as a Feature on Demand
• The removal is delivered through servicing, tracked in the KB5120998 update discussion
• WMI itself remains fully supported; only the legacy command-line utility is gone
• Microsoft recommends PowerShell, the WMI COM API, and .NET libraries as replacements

What Is a Living-Off-the-Land Binary?

A LOLBin is a legitimate, Microsoft-signed tool that an attacker uses instead of bringing their own malware. The appeal is straightforward: signed system binaries do not trip signature-based detection, they are present on every machine, and their execution looks superficially like administration because it often is administration.

WMIC was close to ideal for this. It was signed, universally available, scriptable, and capable of reaching deep into system management. In real intrusions it was used to delete Shadow Volume Copies so victims could not restore from local snapshots — the standard opening move in a ransomware deployment — as well as to enumerate and uninstall antivirus products and to add Microsoft Defender exclusions ahead of dropping a payload.

Removing the binary does not remove the capability, since WMI is still there and reachable through other interfaces. What it removes is the convenient, pre-installed, easily-scripted front door, and it forces adversary tooling onto paths that are better instrumented.

The Ten-Year Deprecation Timeline

Microsoft did not do this quickly, and the sequence is instructive:

• 2016: deprecated in Windows Server 2012
• 2021: deprecated in Windows 10 21H1
• 2022: converted to a Feature on Demand in Windows 11 22H2
• 2024: announced for complete removal
• 2026: removed by default from Windows 11 24H2 and 25H2, and no longer installable as a Feature on Demand

A decade of notice is the price of removing something load-bearing from an operating system that runs a large share of the world's enterprise infrastructure. The Feature on Demand stage in particular gave organizations a way to keep working while migrating, and the current change closes that escape hatch.

What Should Administrators Do Now?

The migration path is PowerShell. The CIM cmdlets — Get-CimInstance and its relatives — cover essentially everything WMIC did, with better output handling since they return objects rather than text you have to parse. For applications rather than scripts, the WMI COM API and the .NET management libraries remain fully supported.

Concretely, this week's work looks like:

• Grep your scripts, scheduled tasks, and imaging and deployment tooling for WMIC invocations. Vendor installers and older monitoring agents are common hiding places.
• Convert findings to CIM cmdlets and test on a 25H2 image rather than assuming behavioral parity.
• Update detection rules. Alerts keyed on WMIC process creation will go quiet — that is a coverage gap, not a win, so make sure equivalent WMI activity is being watched through other telemetry.
• Confirm your endpoint tooling monitors WMI provider activity directly, since that is where the behavior moves.

That third point deserves emphasis. A detection that stops firing because the binary no longer exists can look like an improvement on a dashboard while the underlying technique continues through a different interface.

Why This Matters Beyond One Binary

The broader lesson is that shrinking the toolset available to an intruder inside a compromised host is a defense that scales without needing to predict the specific threat. It is the same logic behind the phased-migration approach in Google Cloud's post-quantum cryptography roadmap — long timelines, clear replacements, and eventual removal of the weak option rather than indefinite optional hardening.

For teams applying the same thinking to newer surfaces, our guide on securing AI coding agents in CI pipelines covers reducing what an automated process can reach. More in our AI security coverage.

Sources: BleepingComputer — August 2026; Microsoft Support — August 2026; BetaNews — August 2026.