What changed

The reference documentation for the utility, with an ms.date of 20 August 2026 and last updated on 21 August 2026, carries an Important notice stating that starting in August 2026, Windows 11 versions 24H2 and 25H2 no longer include the Windows Management Instrumentation Command-line utility and it cannot be added back as a Feature on Demand, that WMIC is already removed by default in new installations of these versions, that the change affects only the WMIC utility, and that Windows Management Instrumentation itself remains supported. A second Important notice on the same page records the longer history: WMIC is deprecated as of Windows 10 version 21H1 and as of the 21H1 semi-annual channel release of Windows Server, and is superseded by Windows PowerShell for WMI. Microsoft also published the change through the Windows Message Center on 27 August 2026, advising organisations to migrate applications, scripts, deployment tools and monitoring systems that use WMIC to PowerShell or to supported WMI programming interfaces. The Message Center entry summarises the scope as version 24H2 and later; the product documentation names versions 24H2 and 25H2, and this article uses the documentation’s wording as the narrower and more precisely dated of the two.

The risk is quiet, which is what makes it worth writing down. A script that calls a command which no longer exists does not raise an alert, does not stop a user working, and frequently does not fail loudly enough for anyone to notice. It returns nothing, the calling task completes, and the report it feeds carries fewer rows than it should. An asset inventory that silently under-reports is worse than one that visibly breaks, because it keeps being trusted.

What the term means in plain language

Windows Management Instrumentation, or WMI, is the long-standing Windows subsystem that exposes information about a machine and its software in a queryable form: the serial number, the installed memory, the operating system build, the list of installed products, the running services. WMIC was the command-line front end to that subsystem, a single executable that could be called from a batch file or a scheduled task to return any of it as text. The distinction matters throughout this article and it is the point most likely to be misread: WMI is the data source and it is unaffected, while WMIC was one way of asking it questions and it is the thing that has gone. PowerShell provides the same access through its CIM cmdlets.

This distinction matters because product status is not the same as business readiness. Availability, support and compatibility are separate questions. A service can be available but unsupported, supported but capacity-constrained, or technically updated while a customer-specific process has stopped working.

Why this matters to a South African organisation

South African teams often operate with tight specialist capacity, rand-sensitive budgets and business processes that cannot be paused while a replacement is sourced. Localisation, regional cloud capacity and long procurement lead times can narrow the recovery options. The practical response is to use the available test window before it becomes an emergency window.

The consequence belongs to the business process, not only the technology team. Finance month-end, customer transactions, data pipelines and ERP extensions all cross technical and operational ownership. A change should therefore be accepted only when the service owner and the business owner can see the same evidence.

The hidden exposure

Microsoft’s documentation states that starting in August 2026, Windows 11 versions 24H2 and 25H2 no longer include the Windows Management Instrumentation command-line utility, WMIC, and that it cannot be added back as a Feature on Demand. The tool has been deprecated since Windows 10 version 21H1, so the removal itself is not new. What is new is that the documented way to restore it has been removed with it.

Normal operation is weak evidence. It proves only that yesterday’s combination of platform, configuration and workload completed. It does not prove that the next capacity allocation, lifecycle enforcement or major release will preserve the same result. An owner needs an inventory, a representative test and a dated decision.

Decision path

Nothing here is a surprise on the facts, and pretending otherwise would be dishonest: this utility was marked deprecated five years ago and Microsoft has said for most of that time that PowerShell replaces it. The change worth acting on is smaller and more specific. Until now the removal came with a documented escape hatch, because WMIC shipped as an optional Windows feature and an administrator who found a broken script could add it back while the script was fixed properly. Microsoft’s current wording removes that: it cannot be added back as a Feature on Demand. The migration is therefore no longer optional in the practical sense, and more to the point, a discovery made after a fleet has moved to 24H2 or 25H2 can no longer be answered by restoring the tool for a fortnight. That reframes the decision from a technical migration to a timing question. If your fleet is already on 24H2 or 25H2, the work is investigative rather than preventative, and the first task is finding out what has been failing quietly rather than planning a change. If you are still moving, this belongs on the pre-flight list for the upgrade rather than in the backlog behind it. Braintree’s reading rather than Microsoft’s: the population most exposed is not the organisation with a large scripting practice, which will know what it calls. It is the one with a handful of old, reliable scripts that nobody has opened in years, and the third-party tools that run their own inventory logic where the dependency is invisible from outside. That second category is the reason the action here includes asking vendors a direct question rather than only searching your own files.

Record the alternatives that were rejected and why. That prevents the next reviewer from reopening the entire question without context. Where the preferred path cannot be completed inside seven days, approve a time-bound exception with a responsible owner, expiry date and compensating control.

Technical test plan

Search rather than audit, and search broadly, because the calls will not be where an inventory of your applications would put them. The string to look for is short and distinctive, so grep across script repositories, the SYSVOL logon script share, deployment shares and task sequences, RMM and monitoring agent configuration, and any custom actions inside packaged applications you build yourself. Scheduled tasks are the most commonly missed location, and the most commonly damaging, because a task that produces a report is exactly the kind of thing whose empty output nobody investigates. Translation to PowerShell is mechanical for the common cases. The CIM cmdlets query the same classes the utility exposed, so a call that asked for the BIOS serial number, the operating system caption or the physical memory maps onto Get-CimInstance against the same class name, and the class names themselves do not change. Two practical cautions apply. The output shape is different, so anything that parsed the utility’s text output line by line needs its parsing rewritten rather than its command swapped, and this is where a naive substitution most often produces a script that runs cleanly and returns the wrong thing. And where a call used the utility’s remote node capability, the modern equivalent runs over the same infrastructure as the rest of your remote management rather than over the older path, so remote calls are worth testing against a real target rather than only against the local machine. Finally, verify the state on a machine rather than trusting the documentation about your own fleet, because 23H2 and Windows Server builds are not in the scope of this removal and a mixed estate will behave differently depending on where the script lands.

Use production-representative conditions without exposing production data unnecessarily. Capture the starting configuration, exact version, time of test and expected result. A pass requires evidence from the real workflow, not only a successful login or an unchanged dashboard.

Primary owner

Primary owner: Whoever owns endpoint management and the scripts that run against the fleet, typically the IT operations or desktop lead, with the application owner for any third-party tool that runs its own inventory or deployment logic.

The named owner coordinates platform, application, commercial and business-process decisions. Contributors may perform the work, but accountability cannot be distributed across a meeting invite. The owner closes the test, exception and evidence record.

Action within seven days

Action within seven days: Search your own estate for the string wmic: in scripts, in scheduled tasks, in deployment shares and task sequences, in monitoring agent configuration and in any custom logon or startup scripts. Where it is found, replace the call with the equivalent PowerShell CIM cmdlet and re-test the output rather than assuming parity. Then ask your software vendors directly, because you cannot search inside their installers, and keep both the search output and the vendor answers.

Start with the highest-consequence workload. Assign the people, date and pass criteria before the test begins. If the first test fails, record the failure as evidence and open remediation with a deadline rather than hiding it behind a general project status.

Evidence to retain

Evidence to retain: The dated search results across scripts, scheduled tasks, deployment shares and monitoring configuration showing every call to WMIC and where it lives, the record of which calls were replaced and what they were replaced with, and the written vendor responses confirming whether their products depend on the utility.

Store the evidence with the platform or change record. Include source exports and machine-readable results where possible. The next reviewer should be able to reproduce the conclusion without rebuilding it from email, chat or memory.

Frequently asked questions

Is WMI itself going away?

No. Microsoft states plainly that the change affects only the WMIC utility and that Windows Management Instrumentation remains supported. Only the command-line front end has been removed.

Which Windows versions are affected?

The product documentation names Windows 11 versions 24H2 and 25H2. The Windows Message Center entry summarises it as version 24H2 and later. This article follows the documentation as the narrower statement.

Can we reinstall it if something breaks?

Microsoft’s wording is that it cannot be added back as a Feature on Demand. That is the substantive change, because until now the optional-feature route was the documented way to restore it.

How will we know if something has already broken?

Frequently you will not, without looking. A call to a missing command tends to fail without stopping the script around it, so the visible symptom is a report with missing rows or an inventory that has quietly stopped updating rather than an error.

What replaces it?

PowerShell. Microsoft states that the utility is superseded by Windows PowerShell for WMI, and the CIM cmdlets query the same classes, so the information itself is unchanged.

Is a straight find-and-replace safe?

Not on its own. The classes are the same but the output shape is not, so any script that parsed the utility’s text output needs its parsing rewritten. That is the failure that runs cleanly and returns the wrong answer.

How do we find out whether our third-party software depends on it?

Ask the vendor directly and keep the answer in writing. You can search your own scripts but you cannot search inside somebody else’s installer, and this is the category most likely to be missed.

The Braintree view

Microsoft’s announcement supplies the platform fact. The customer control begins after that fact: identify the exposed process, name the owner, test the real dependency and retain a decision that can survive audit or staff turnover. Braintree can help structure the inventory, build the representative test and translate the result into a controlled implementation plan.

Use the seven-day action as the entry point. Do not wait for a renewal, support refusal or enforced update to reveal work that can be measured now.