WMIC is gone from Windows 11 24H2 and 25H2, and your wmic.exe rules go with it

Microsoft has removed the Windows Management Instrumentation Command-line utility, WMIC, from Windows 11 24H2 and 25H2 and from the Windows 11 beta builds shipped this week ^[1]. This is removal rather than another deprecation notice: the tool is gone by default from new installations of both releases and is no longer available as a Feature on Demand ^[2].

The paperwork has been filed for years. Microsoft deprecated WMIC in Windows Server 2012 in 2016 and in Windows 10 21H1 in 2021, converted it to a Feature on Demand with Windows 11 22H2 in 2022, and said in January 2024 that it would be removed outright after first being disabled by default ^[3]. That is eight years between the first deprecation and the announcement of removal ^[13]. In September the company said WMIC would be removed after upgrading to Windows 11 25H2 and later ^[4]. Monday's build note was short: "Windows Management Instrumentation Command-line (WMIC) has been removed in this release. This change is part of the ongoing deprecation and removal of WMIC from Windows" ^[5].

Two details matter for anyone running a fleet. First, WMI itself is untouched; the change applies only to the legacy WMIC component, which was a text-mode front end onto WMI ^[6][14]. Microsoft's administrator guidance points to PowerShell, WMI's COM API, .NET libraries, and other scripting languages for the work WMIC used to do ^[7]. Second, the language separates new installations from upgrades: removal by default is described for new installs of 24H2 and 25H2 ^[2], while the September notice framed removal as happening after upgrading to 25H2 and later ^[4]. Expect a mixed estate for a while, which means inventory before assumption.

The detection side is where this bites quietly. WMIC has long been treated as a LOLBIN, a Microsoft-signed built-in that attackers abuse ^[8]. Ransomware encryptors routinely call it to delete Shadow Volume Copies so victims cannot recover their files ^[9]. Other actors have used it to enumerate installed security products and uninstall them ^[10], and malware has used it to add Microsoft Defender exclusions to evade detection ^[11]. Microsoft says the removal is intended to improve the operating system's overall security by breaking that range of tactics ^[12].

On a host where the binary is absent, a rule matching a wmic shadowcopy delete command line cannot fire. That is not the same as the behaviour stopping. The shadow copy deletion, the security-product enumeration and the Defender exclusion are all WMI and Windows operations, and WMI is still there ^[6], reachable through the same COM API, .NET and PowerShell paths Microsoft is now recommending to administrators ^[7]. Content that was written against a process name and a command-line string is what breaks; content written against the effect, such as the deletion of shadow copies or a new exclusion path, survives the change.

The unglamorous work is on the admin side. Scheduled tasks, imaging steps, monitoring probes, software inventory scripts and third-party installers that shell out to wmic will fail on a 24H2 or 25H2 machine with no binary present ^[2], and failure modes for a missing executable tend to be silent in a wrapper script.

What to watch: an inventory pass that records which hosts still have wmic.exe and at which build; the volume of wmic.exe process telemetry across the estate, where a sharp drop is confirmation and a residual trickle identifies the machines and agents still depending on it; and whether alert rules that reference wmic by name have been paired with behaviour-based equivalents before they go permanently quiet ^[1][6].