This week’s mandatory Windows 11 update has finally removed WMIC, a legitimate tool that has been abused by ransomware. Although users outside enterprise environments may never have heard of WMIC, the risk was not limited to businesses. Regular consumers could also be affected if WMIC was installed on their PCs.
WMIC, better known as Windows Management Instrumentation Command-line, has been part of Windows for decades and is not malware. It is a legitimate command-line tool that allowed users—primarily enterprises—to query and manage Windows PCs through Windows Management Instrumentation (WMI). However, people outside IT departments also used it for Windows management and automation, which is why WMIC was preinstalled on consumer editions.
MS deprecated WMIC with the release of Windows 10 version 21H1 in May 2021, but it remained preinstalled as a Feature on Demand. With Windows 11 KB5124008, the September 2026 Update, WMIC has now been fully removed and is no longer available as a Feature on Demand.
MS recommends migrating apps, scripts, and workflows that still depend on WMIC to supported alternatives rather than restoring the utility.
WMIC Allowed Ransomware to Attack Everyone, Including Consumers
WMIC-related abuse also affected ordinary home users. One of the most common tactics involved destroying Windows’ Shadow Volume Copies.
Windows maintains Shadow Volume Copies to help users recover previous versions of files, including personal files. Windows recovery features are also based on the broader concept of restoring the system to an earlier state.
Attackers abusing WMIC could first attempt to delete Shadow Volume Copies, preventing users from easily returning to a previous state or recovering data after ransomware encrypted it. This threat was not merely theoretical. Credible reports showed that TeslaCrypt 4.1b, a known ransomware strain, used WMIC to delete Shadow Volume Copies from infected PCs.
Windows Latest understands that WMIC was also abused by Serpent, WhiteRose, Zenis, Saturn, and numerous other ransomware families.
Even the infamous WannaCry ransomware deleted Shadow Volume Copies, disabled Windows startup recovery, and removed backup information. One of its commands invoked WMIC to delete shadow copies.
WMIC did not cause the original WannaCry infection. However, ransomware could abuse the legitimate tool already available in Windows unless it had been manually disabled or removed.
WMIC has also been abused to interfere with Windows antivirus protection. For example, one Trojan used WMIC to determine whether Windows Defender was running and then added itself to Defender’s exclusion list.
In 2021, the same year MS declared WMIC deprecated, attackers distributed DeroHE ransomware through forums. That ransomware also used WMIC commands to add MS Defender exclusions.
In its investigation, Windows Latest found that removing WMIC could immediately disrupt attacker techniques and ransomware tactics that specifically depend on the utility. Attackers must now find an alternative or somehow convince users to reinstall WMIC.
How to Verify Whether WMIC Has Been Removed from Windows
Install the September 2026 Update through Windows Update. It appears as Windows 11 KB5124008 and upgrades PCs to Build 26200.9445.
Confirm that the PC is running Build 26200.9445 or newer. This build removes WMIC and patches hundreds of major security issues.
Open Terminal or Command Prompt and enter WMIC. If the command returns an error stating that it is not recognized, WMIC has been removed.
Previously, entering the WMIC command displayed a brief description explaining how to use the command-line tool.
MS Says Not to Restore WMIC Unless It Is Necessary
A MS support document allows users to restore WMIC through a downloadable package, but the company makes clear that this option is intended only for apps, scripts, or workflows that still depend on the utility.
If you do not know what WMIC is, you probably do not need to install it. If a third-party app or an untrusted website suddenly instructs you to download WMIC, proceed with extreme caution.
For organizations that still depend on WMIC, MS provides the downloadable package as a temporary compatibility workaround. However, the company wants users to migrate to supported alternatives.
“We encourage you to move away from this workaround as soon as possible,” MS warned users who still plan to force-install WMIC.
Windows Latest depends on readers like you. Make us your Preferred Source on Google Discover and Google Search, and help our independent reporting reach more people.
