The Tool That Was Too Useful to Kill — Until Now

For twenty-five years, a small command-line tool called WMIC quietly lived inside every Windows computer. Administrators used it to manage systems. IT teams used it to run diagnostics. And hackers? They loved it.

Now, with the release of Windows 11 update KB5120998 in August 2026, Microsoft is finally pulling the plug. WMIC is gone.

So What Even Is WMIC?

WMIC stands for Windows Management Instrumentation Command-line. That's a mouthful — but the idea is simple. It's a command-line shortcut that lets you ask Windows deep questions about itself. What processor do I have? What software is installed? What services are running?

You could type one line into a black terminal window and get instant answers about a PC's hardware, software, and network status. System administrators used it for decades to manage fleets of computers remotely — especially in corporate environments where Windows PCs were everywhere.

WMIC shipped with Windows since the early 2000s. It was practical, powerful, and completely legitimate. Which is exactly what made it dangerous.

How Hackers Turned a Windows Tool Into a Weapon

Here's the problem with having a powerful, trusted, Microsoft-signed tool baked into every Windows machine: attackers can use it too.

Security researchers call this "living off the land" — or LOLBIN (Living Off the Land Binary) attacks. Instead of bringing their own suspicious malware tools, hackers just use the ones already sitting on your computer. Because WMIC is a legitimate Microsoft tool, antivirus software and security teams often let it run without question. That's the trap.

WMIC became one of the most abused tools in the ransomware playbook.

LockBit: The Textbook Attack

LockBit, one of the most destructive ransomware operations in history, was a master of WMIC abuse. Before encrypting a victim's files and demanding millions in ransom, LockBit operators used WMIC to do three critical things.

First: delete all backups. The command wmic SHADOWCOPY /nointeractive wiped Windows Volume Shadow Copies — the automatic backup snapshots Windows quietly keeps. No backups, no recovery without paying the ransom.

Second: spread across the network. Using wmic /node:[IP address] process call create "[malware path]", attackers ran the ransomware remotely on every machine they could reach on a company's network. One infected PC became hundreds.

Third: silence the defences. LockBit operators ran wmic product where name='[antivirus name]' call uninstall to silently remove security software before encryption began — so no alarms would trigger.

All of that: done with Microsoft's own, legitimate, built-in tool.

BlackCat and Emotet Joined the Party

LockBit wasn't alone. BlackCat (also called ALPHV), another major ransomware gang, ran wmic.exe Shadowcopy Delete as a standard step in every attack. First, wipe the backups. Then, encrypt. A clean, repeatable process used across hundreds of victims.

Emotet — the notorious malware described at its peak as the world's most dangerous — went deeper. Instead of just using WMIC commands, it exploited the underlying WMI system to secretly launch hidden PowerShell scripts. An infected Word document would silently kick off an entire attack chain using only Windows' own infrastructure. No external hacker tools needed. Nothing suspicious to catch.

Security researchers at MITRE — the organisation that maintains the global catalogue of cyberattack techniques — list WMI abuse under technique T1047. It appears in the playbooks of dozens of documented threat groups worldwide.

The Long Goodbye: Years in the Making

Microsoft didn't decide overnight to remove WMIC. This has been coming for a very long time — and the company was patient, arguably too patient, about it.

In 2021, WMIC was officially marked as deprecated in Windows 10 version 21H1. "Deprecated" means: still works for now, but we're warning you it won't be here forever. By 2022, Windows 11 22H2 made it an optional add-on — disabled by default but still installable if you needed it.

By 2024, even that optional add-on was turned off by default in Windows 11 23H2 and 24H2. The writing was on the wall.

Now in August 2026, update KB5120998 — covering Windows 11 builds 26100.9267 and 26200.9267 — makes it final. WMIC is removed. Not optional. Not re-installable. Gone.

Wait — Is All of WMI Gone?

No — and this is an important distinction. Microsoft has been very clear: only the wmic.exe command-line tool is being removed. The underlying WMI (Windows Management Instrumentation) system — the data engine behind it — stays in Windows indefinitely.

Think of it this way: the coffee machine (WMI) stays. They're just removing one button (WMIC) that hackers kept pressing.

What Replaces It?

PowerShell has been the official replacement for years. Microsoft's recommended swap is the Get-CimInstance cmdlet — which does the same job as WMIC but with proper logging and more control.

For example: wmic cpu get name becomes Get-CimInstance Win32_Processor | Select-Object Name in PowerShell. More to type, yes. But also far more auditable — every PowerShell command is logged, making attackers' lives significantly harder.

Microsoft has been pushing administrators toward PowerShell since Windows 8. The migration path is well-established. The tools exist. It just took this long for the old one to die.

What Should You Do?

If you're a regular home user: nothing. You probably never typed WMIC in your life, and this update affects you only in the positive direction — one fewer attack surface on your PC.

If you're in IT: audit any scripts, batch files, or third-party tools in your environment that call wmic.exe directly. When KB5120998 lands, those scripts will silently fail. Time to migrate to PowerShell CIM cmdlets — this change has been signalled for five years.

Why This Actually Matters

Removing a built-in Windows tool might sound like minor housekeeping. It isn't.

WMIC appeared in the documented attack chains of LockBit, BlackCat, Conti, Ryuk, Emotet, and dozens of other threat actors. Every time a ransomware gang wanted to silently delete backups, spread across a network, or disable a company's security software — WMIC was often in the toolbox. Because it was Microsoft's own binary, it slipped past defences that would have flagged external malware.

Removing it forces attackers to find noisier, less trusted alternatives. It won't stop ransomware on its own. Nothing single-handedly stops ransomware. But it closes a door that criminals have walked through, again and again, for more than a decade.

Sometimes the best security update isn't about adding something new. It's about finally taking something dangerous away.