Microsoft removes WMIC tool in Windows 11 security update

Microsoft has officially removed the Windows Management Instrumentation Command-line (WMIC) tool in the Windows 11 September 2026 update (KB5124008). While the tool was deprecated in 2021, it remained available as a Feature on Demand until this release.

Security experts note that WMIC has been frequently exploited by ransomware strains, such as TeslaCrypt 4.1b, WannaCry, and Serpent, to delete Windows Shadow Volume Copies. By destroying these copies, attackers prevent users from recovering files after an encryption attack. The tool has also been used to create exceptions in Microsoft Defender to hide malicious code.

In addition to the removal of WMIC, the September patch cycle is one of the largest in Microsoft's history. Security trackers report that the update addresses between 964 and 997 vulnerabilities, with 105 classified as critical. Microsoft advises users and enterprises to migrate any existing scripts or workflows to supported alternatives rather than attempting to manually restore WMIC.