www.it-connect.fr
Windows 11 24H2 and 25H2: WMIC Is Gone for Good
In September 2025, Microsoft announced the end of WMIC. It is now officially gone! Release notes published in mid-August 2026 confirm that the utility has been removed from Windows 11 24H2 and 25H2, as well as from the latest Insider builds. And this time, it is no longer even reinstallable as an optional feature. For attackers, that is one fewer Microsoft tool in their toolkit, but it could also hurt some sysadmins.
wmic.exe: Microsoft is closing the book for good
When we reported the announcement of WMIC removal in Windows 11 25H2, there was still an escape hatch: on 24H2 machines, the tool could still be reinstalled through Windows 11 optional features. Microsoft has decided to eliminate that option.
In fact, Microsoft has updated its documentation for the latest Windows builds, and it is now spelled out in black and white. You can verify it by following these links:
- The 26100.9267 and 26200.9267 build (KB5120998), released on August 14, 2026 in the Release Preview channel for Windows 11 24H2 and 25H2.
- The 26220.9202 build in the Beta channel, published on August 17, 2026.
- The 28020.2731 build in the Beta channel for the upcoming 26H1 release, published the same day.
What matters most for production and current releases is the Release Preview documentation. Here is what it says: "Starting in August 2026, Windows 11, versions 24H2 and 25H2 no longer include the WMIC utility."
Microsoft specifies that the tool is already removed by default on new installations (which is nothing new), while also adding that it is no longer available as a Feature on Demand (optional features installable on demand by the user).
I should also remind you that only the command-line utility is disappearing. The WMI infrastructure remains a full-fledged Windows component.
A LOLBin attackers have abused for years
I have been telling you about the end of WMIC for quite some time, and Microsoft has as well. Redmond had already deprecated WMIC in 2016 on Windows Server 2012, then again in 2021 with Windows 10 21H1, as the command reference page on Microsoft Learn still notes. The tool then became an optional feature with Windows 11 22H2, before being disabled by default on 23H2 and 24H2.
The end of wmic is a good thing from a defensive standpoint, since it has long been listed as a LOLBin. In other words, it is a legitimate Microsoft-signed executable that attackers can abuse. The entry dedicated to it by the LOLBAS project documents several abuses of this tool, all tied to MITRE ATT&CK techniques. In particular:
- Execution of an arbitrary binary, both locally and on a remote machine via the
/node:option. - Execution of JScript or VBScript code embedded in a remotely retrieved XSL stylesheet.
- Launching an executable hidden inside an alternate data stream.
- Creating a scheduled task on a remote workstation.
There have been cases where this tool was used by ransomware before data encryption. That said, removing the binary does not make these techniques disappear, since WMI remains accessible through other paths (PowerShell, in particular). As an admin, you can still query WMI using Get-CimInstance and Get-WmiObject.
