Microsoft spent ten years removing one command, because criminals used it more than administrators did

Microsoft has removed WMIC — the Windows Management Instrumentation Command-line tool — from Windows 11 24H2 and 25H2.

There is no CVE. WMIC was never vulnerable. It is a Microsoft-signed executable that has always done precisely what its documentation says, which is exactly the problem.

What a LOLBin actually is

A living-off-the-land binary is a legitimate tool that ships with the operating system and is useful to an attacker.

It defeats several defences at once. It is signed by Microsoft, so signature checks pass. It is already present, so nothing needs to be downloaded and nothing crosses the network for an EDR to inspect. And it is genuinely used by administrators, so its presence in a process tree is not by itself suspicious.

There is nothing to patch. The tool is not broken.

What WMIC was used for

The three that appear most often in incident reports:

• Deleting Shadow Volume Copies, so a ransomware victim cannot restore from them
• Querying and uninstalling security software
• Adding exclusions to Microsoft Defender, so the payload lands in a folder nothing scans

Every one of those is a legitimate administrative capability. The shadow copy deletion is the one that has cost the most money — it is a standard step in the ransomware playbook, executed with a command Microsoft shipped and signed, seconds before encryption begins.

Ten years is the story

A decade between "we advise against this" and "it is gone".

That is not incompetence, and it is worth understanding why rather than complaining about it. WMIC is in scripts. Not modern scripts — scripts written in 2009 by someone who left, running on a schedule nobody has opened since, in an environment where the person who could tell you what it does retired. Removing a built-in command breaks those silently, and Microsoft's customers are the ones holding them.

The gradual path — deprecate, then make optional, then announce, then remove — is what removing anything from a platform with that much inertia actually looks like.

Do not expect a quiet quarter

Removing WMIC removes one binary, not the technique.

The replacements Microsoft points to for legitimate work — PowerShell, the WMI COM API, .NET libraries — are the same tools already used by attackers who moved on from WMIC years ago. vssadmin still deletes shadow copies. The underlying WMI service is untouched, because it is load-bearing.

What this changes is one convenient, heavily-signatured path. Detections written against WMIC command lines will go quiet, and the correct read of that silence is not that the behaviour stopped.

The durable version of the control was never "watch for WMIC". It is watching for the behaviour — something deleting shadow copies, something modifying Defender exclusions, something uninstalling security software — regardless of which signed binary asked.

What to do

• Find your WMIC dependencies before 24H2 reaches your fleet. Search scripts, scheduled tasks, SCCM packages and monitoring agents for the string. This is the practical work and it takes longer than you think.
• Re-express your detections in terms of outcomes, not tool names. Shadow copy deletion is the alert; the binary that did it is a field in it.
• Check whether anything in your estate re-enables it. It was a Feature on Demand before removal, and some builds may still allow installation.
• Treat this as a template. The same reasoning applies to every other LOLBin you have not audited, and the list is long.

What is not established

• Whether removal is final across all editions and channels. The reporting covers Windows 11 24H2 and 25H2.
• What proportion of estates still depend on it. No figures have been published.
• Whether attackers see any real cost from this. The alternatives are documented and already in use.