Microsoft has completed the WMIC removal with this week’s mandatory Windows 11 September 2026 Update. The company says the tool has been abused by ransomware for years, and it wants you to leave it gone rather than restore it.
WMIC has shipped with Windows for decades, but it was never meant to be a permanent fixture. Microsoft first deprecated WMIC with the release of Windows 10 version 21H1 in May 2021, yet kept it available as a “Feature on Demand.” With Windows 11 KB5124008, the September 2026 Update, the utility is now fully removed and is no longer offered as a downloadable feature.
What WMIC was and why Microsoft pulled it
WMIC, short for Windows Management Instrumentation Command-line, is a legitimate command-line utility that lets you query and manage Windows PCs through Windows Management Instrumentation (WMI). It was a staple in enterprise environments, where IT teams used it to inventory machines, run remote commands, and automate routine tasks.
But WMIC also crept into consumer editions. Because everyday users relied on it for system management and scripting, Microsoft preinstalled it on regular PCs. That decision is exactly what made it a security liability down the line.
Microsoft’s official position, laid out in its deprecated-features documentation, is that organizations should migrate apps, scripts, and workflows off WMIC and move to supported alternatives — not bring the tool back.
How ransomware abused WMIC against everyone
The real reason for the WMIC removal is that cybercriminals turned a legitimate tool into a weapon. WMIC-related abuse was never limited to businesses; ordinary home users were at risk too, as long as the tool was present on their machines.
One of the most common tactics was destroying Windows Shadow Volume Copies — the hidden backups that let you recover previous versions of files. If ransomware encrypts your data but you’ve already lost your shadow copies, your path back to a working system disappears.
This isn’t hypothetical. According to reports, the TeslaCrypt 4.1b ransomware strain used WMIC to delete shadow copies from infected PCs. Windows Latest understands that WMIC was also abused by the Serpent, WhiteRose, Zenis, and Saturn ransomware families.
The infamous WannaCry ransomware did something similar: it deleted Shadow Volume Copies, disabled startup recovery, and stripped backup information — one of those commands invoked WMIC to delete shadow copies. Microsoft isn’t claiming WMIC caused the original WannaCry infection, but the worm proved that attackers could abuse a tool already sitting inside Windows.
WMIC was also used to undermine antivirus protection. One Gootkit-based trojan reportedly used WMIC to check whether Windows Defender was running, then added itself to Defender’s exclusion list. In 2021, the DeroHE ransomware used WMIC commands to do the same.
Based on Windows Latest’s investigation, removing WMIC instantly disrupts these attacker techniques — forcing criminals to either find a different approach or convince you to install the tool again.
How to verify WMIC is gone
First, make sure your PC has received the September 2026 Update. It arrives as Windows 11 KB5124008 and bumps your system to Build 26200.9445. If you’re running that build or newer, WMIC has been dropped, along with patches for hundreds of security issues.
To confirm, open Terminal or Command Prompt and type WMIC. On Build 26200.9445 or newer, you’ll get an error saying the command isn’t recognized. Previously, typing WMIC printed a brief description of how to use the tool — that output is now gone.
Microsoft says don’t restore WMIC unless you need it
Microsoft did include a way to bring WMIC back. A support document offers a downloadable package for anyone whose apps, scripts, or workflows still depend on the utility. But the company is explicit that this is a temporary compatibility workaround, not a return to normal.
“We encourage you to move away from this workaround as soon as possible,” Microsoft warned. If you don’t know what WMIC is, you almost certainly don’t need it. And if a third-party app or an untrusted site suddenly tells you to download WMIC, treat that as a red flag before installing anything.
Why the WMIC removal matters for you
For most Windows 11 users, this WMIC removal is a quiet win. You won’t notice a difference in daily use, but you’ve just lost one more tool that ransomware could have pointed at your files or your antivirus. If you run your own scripts or automation that relied on WMIC, now is the time to migrate them to supported alternatives before the update lands.
How to get the update
Open Windows Update and check for updates. The September 2026 Update ships as KB5124008 and installs Build 26200.9445. Microsoft is pushing it as a mandatory update, so most PCs will receive it automatically. If you want the offline installer, direct .msu download links were published alongside the release.
Source: Windows Latest
Build details:
- kb5124008
Over to you: Do you still run scripts that depend on WMIC, or are you glad to see it gone for good?
