Windows 11 has a command-line tool called Windows Management Instrumentation Command-line (WMIC), which is mostly used by enterprises, but it’s also present on consumer PCs, and it has often been abused by cybercriminals to deploy malware or ransomware against even home users.

Windows Latest recently reported that Windows 11’s next Patch Tuesday update removes WMIC once and for all. I can now confirm that the legacy tool is indeed entirely gone in early builds of the September 2026 Update, which means it cannot be turned on using Windows 11’s Optional Features page or any terminal command. This is not a gradual rollout.

I installed an early build of the Windows 11 September 2026 Patch Tuesday update, searched for WMIC, and, as expected, no results showed up. Instead, I somehow got a recommendation to open Microsoft Edge, which could be a bug where Windows Search is confusing WMIC with something browser-related since the legacy tool is entirely gone.

I also looked inside the Windows partition, and there are no traces of WMIC-related components. And yes, running the `wmic` command in Command Prompt finally returns a “command not recognized” error:

For comparison, here’s a fresh install of the Windows 11 August 2026 Update, where WMIC still shows up in Windows Search results, Command Prompt, and everywhere else:

WMIC has been part of Windows for decades, but Microsoft has been gradually trying to remove it after deprecating the tool years ago. Microsoft later marked WMIC as deprecated on PCs running Windows 10 21H1 or newer, which meant it was no longer being actively developed.

Fast forward to 2025, Microsoft said it would no longer install WMIC by default on clean installs of Windows 11 25H2, but it would remain available on existing PCs and could still be brought back as an optional feature.

With Windows 11’s September 2026 Update, or Windows 11 26H2, Microsoft is fully removing WMIC. Until now, it has remained available as a Feature on Demand (FoD), which meant users could still enable it. Once you install the September 2026 Update when it rolls out, WMIC will be impossible to bring back.

“Windows Management Instrumentation Command-line (WMIC) has been removed in this release. This change is part of the ongoing deprecation and removal of WMIC from Windows,” Microsoft confirmed in updated release notes, and we were able to reproduce the change on our test machines.

As I noted above, WMIC is removed in the September 2026 Update, and my PC is running a preview build of that same update, which is why the tool is no longer present.

Why is Microsoft removing Windows Management Instrumentation Command-line (WMIC)?

WMIC has historically been useful for enterprises because it allows IT admins to run scripts and query Windows systems without relying on PowerShell or other modern management tools.

But WMIC is also considered a LOLBIN, or living-off-the-land binary, which means it’s a legitimate Microsoft-signed Windows component that threat actors can abuse to carry out attacks without bringing their own executable.

In a support document, Microsoft argued that removing WMIC would “improve the security and reliability of Windows.”

“This change helps improve the security and reliability of Windows by removing a legacy component while preserving existing management capabilities through supported alternatives,” the company explained.

“Migrating to these alternatives helps ensure continued compatibility and a seamless management experience across supported Windows versions.”

WMIC’s removal is a big deal because the tool has been abused in the past to help attackers lock victims’ data, identify installed security products, and even remove security software from compromised PCs.

It’s yet another reason not to miss Windows 11’s September 2026 Update, which could be one of the biggest releases of the year. It’ll let you fully disable Bing in Windows Search, make Windows 11 apps open faster, and introduce several other improvements.

Removing WMIC is another important part of that release, particularly as Microsoft continues cleaning up legacy components that have become security liabilities.

The post Tested: Windows 11 has fully removed the legacy tool abused by cybercriminals for malware and ransomware, called WMIC appeared first on Windows Latest