Windows 11 Finally Removes Ransomware-Favored WMIC Tool

Microsoft has finally removed WMIC (Windows Management Instrumentation Command-line) from Windows 11, one of the tools that ransomware attackers abused to delete Shadow Volume Copies and disable antivirus protection. WMIC was a legitimate command-line tool used for managing Windows PCs through Windows Management Instrumentation (WMI), but it was deprecated by Microsoft in May 2021 with the release of Windows 10 version 21H1.

However, even after deprecation, WMIC remained preinstalled on consumer editions as a Feature on Demand. The September 2026 Update, also known as Windows 11 KB5124008, has finally removed WMIC and made it no longer available as a Feature on Demand. Microsoft recommends migrating apps, scripts, and workflows that still depend on WMIC to supported alternatives rather than restoring the utility.

WMIC-related abuse affected not only businesses but also ordinary home users, with ransomware attackers using the tool to delete Shadow Volume Copies, which can help recover previous versions of files. The removal of WMIC will disrupt some attacker techniques and ransomware tactics that specifically depend on the utility, forcing bad actors to find alternative ways to achieve their goals.

Users who have installed the September 2026 Update can verify if WMIC has been removed by opening Terminal/Command Prompt and typing 'WMIC', which will throw an error indicating the command is not recognized. Microsoft advises against restoring WMIC unless it's absolutely necessary, as it should be avoided due to security risks.