WMIC Removed from Windows 11: Fix "wmic Is Not Recognized"

If Command Prompt just told you "'wmic' is not recognized as an internal or external command, operable program or batch file," nothing on your PC is broken and nothing infected it. Windows deleted WMIC on purpose. Microsoft has now removed the 25-year-old command-line tool from Windows 11 — new installs of 24H2 and 25H2 ship without it, upgrading to 25H2 strips it out, and as of August 2026 the escape hatch is gone too: you can no longer add it back as an optional feature. The reason is the part nobody expects: in its final years, malware and ransomware ran wmic more enthusiastically than administrators did, so Microsoft bricked up that particular doorway for good. The good news sits one layer down — only the little wmic.exe front-end died. The engine behind it, WMI, is completely untouched, and every command you relied on has a one-line PowerShell translation waiting in this post.

Jake got the panicked call on a Monday morning. A small accounting office had moved its machines to Windows 11 25H2 over the weekend, and by 9 a.m. their asset-inventory script — a nine-year-old batch file that collected serial numbers with wmic bios get serialnumber — was throwing "'wmic' is not recognized" on every single PC. Same error, every machine, all at once. The office manager had already decided it was ransomware; what else hits a whole fleet overnight? Jake opened one machine, read the error, and started laughing — gently. The tool they were missing had been removed because of ransomware, not by it. He swapped one line of the batch file for its PowerShell equivalent, pushed the fixed script around, and the "attack" was over in twenty minutes.

Ethan: "Think of a bank that bricked up one teller window — the old side window where, for years, robbers had been sliding fake withdrawal slips through, because it was the one counter that never asked follow-up questions. The vault is untouched. Your account is untouched. Every other counter still works, and the modern counter reads the exact same account numbers. All that’s gone is one door — the one the wrong people loved most."

What actually happened: a ten-year goodbye, now finished

WMIC — the Windows Management Instrumentation Command-line — arrived with Windows XP in 2001. For a quarter century it was the quick way to ask Windows about itself from a black window: serial numbers, disk sizes, installed updates, running processes. If you ever followed a tutorial that began with wmic, you used it.

Its removal was not sudden, even though it probably feels sudden today. Microsoft ran one of the longest deprecation countdowns in Windows history — and almost nobody noticed until the error message appeared:

That last row is the one that changes things, and it deserves a beat of honesty: this is Windows removing a tool from machines that already have it, delivered through the ordinary monthly update pipeline. We are used to updates adding things. The era of updates quietly taking things away — WMIC now, others later — is genuinely new, and if it feels a little unsettling, that’s a reasonable reaction, not paranoia.

Why: malware loved wmic more than you did

Security researchers keep a category called "living-off-the-land binaries" — legitimate tools already sitting on every Windows PC that attackers borrow instead of bringing their own, because borrowed tools don’t trip antivirus alarms. WMIC was a star of that list. One preinstalled command could silently list your security software, enumerate every machine on the network, launch programs on other computers, and delete the backup copies that let you recover from ransomware without paying. Entire ransomware families were built around it.

Meanwhile, the legitimate audience had somewhere better to go: PowerShell reaches the same engine with more power, better output, and — crucially — real logging that security teams can watch. So Microsoft weighed a tool whose honest users had a modern replacement against a tool attackers depended on staying invisible, and chose to remove the doorway. Annoying for your Monday morning, but hard to argue with: the same removal that broke your inventory script also broke a documented step in real attack chains.

WMIC is dead, WMI is fine — the distinction that saves your week

Here is the sentence that turns this from a crisis into a chore: WMIC and WMI are not the same thing, and only WMIC was removed. WMI — Windows Management Instrumentation — is the deep database inside Windows that knows every fact about your machine: hardware, drivers, processes, settings. It remains a core part of Windows, completely unaffected. WMIC was merely one small command-line window into that database. The window is bricked up; the database is fine.

That means every piece of information you ever pulled with wmic is still sitting there, intact, waiting to be asked through the modern window: PowerShell’s Get-CimInstance. Same engine, same class names, same answers — the queries even look recognizably similar. You are not relearning a skill. You are learning a new accent.

The translation table: every common wmic command, replaced

Open PowerShell (right-click Start → Terminal) and use the right-hand column. These run on every supported Windows 11 and Windows 10 machine — no installs, no downloads:

If a command you need is missing from the table, the pattern rescues you: whatever came after wmic path or as wmic’s alias almost always maps to a WMI class named Win32_Something, and Get-CimInstance Win32_Something asks it directly. Microsoft’s own removal notice shows the same one-line pattern — that really is the whole trick.

Fix your own scripts: the 15-minute audit

If you write or inherit batch files, this is the part to actually do — today, not on the morning something breaks. It goes faster than you expect:

1. Find every wmic call you own. In the folder where your scripts live, run: findstr /s /i "wmic" *.bat *.cmd *.ps1 *.vbs — the /s sweeps subfolders, and the output lists every file and line that will break.
2. Translate each line with the table above. In batch files, PowerShell one-liners run as: powershell -NoProfile -Command "Get-CimInstance Win32_BIOS | Select-Object -ExpandProperty SerialNumber".
3. Check your Task Scheduler too: schtasks /query /fo LIST /v | findstr /i wmic catches the scheduled jobs everyone forgets they created in 2019.
4. Test on one machine, then everywhere. The translated commands behave identically on Windows 10 and 11, so one script serves a mixed fleet.

And if step 1 comes back with forty hits and your stomach drops — take a breath. Most scripts reuse the same three or four wmic lines over and over. Translate those once, search-and-replace, and the forty hits collapse into an afternoon coffee’s worth of work.

wmic bios get serialnumber — the most-typed wmic line on Earth, replaced

One wmic command earned its own section, because more people typed it than every other wmic line combined: wmic bios get serialnumber — the warranty-claim command, the asset-tag command, the "support asked for my service tag and the sticker wore off" command. Its replacement, in PowerShell:

Get-CimInstance Win32_BIOS | Select-Object SerialNumber

For a batch file that needs just the bare string, use powershell -NoProfile -Command "(Get-CimInstance Win32_BIOS).SerialNumber". And here is the reassurance for everyone whose search history includes "wmic bios get serialnumber not working": on many desktops — especially self-built and small-brand PCs — the old command was never broken; it faithfully returned To be filled by O.E.M., Default string, or simply a blank, because the manufacturer never wrote a serial into the firmware. The new command reads the same field, so it reports the same blank. That is the machine’s answer, not a failure of yours — the real serial lives on the case sticker or in the UEFI setup screen.

The nearby lookups people chain onto it, translated in the same breath: motherboard details come from Get-CimInstance Win32_BaseBoard, the serial numbers of your actual drives from Get-PhysicalDisk | Select-Object FriendlyName,SerialNumber, the machine UUID that imaging and deployment tools ask for (wmic csproduct get uuid in the old life) from Get-CimInstance Win32_ComputerSystemProduct | Select-Object UUID, and the BIOS/UEFI firmware version from Get-CimInstance Win32_BIOS | Select-Object SMBIOSBIOSVersion — something we covered back when finding your BIOS version already had a PowerShell answer.

The product-key command everyone Googles (it still works — in PowerShell)

For years, the single most-searched wmic line on the internet was the one that reads the Windows product key baked into your motherboard’s firmware: wmic path SoftwareLicensingService get OA3xOriginalProductKey. Thousands of tutorials still teach it, and every one of them now ends in "not recognized." The key itself did not go anywhere — it lives in the firmware, not in wmic. Ask for it the modern way:

(Get-CimInstance -ClassName SoftwareLicensingService).OA3xOriginalProductKey

Run that in PowerShell and, on a machine that came with Windows preinstalled, the 25-character key appears. If it prints nothing, that’s also an answer: your key was typed in rather than embedded (self-built PCs, some upgrades), or your machine uses digital license activation and has no embedded key to show — in which case your license is tied to the hardware through your Microsoft account and you don’t need the string at all. If activation itself is what’s fighting you, our activation error codes guide covers that side.

The wmic command that was hurting you all along

Here is a parting gift from the old tool that makes the goodbye easier: one famous wmic command was quietly damaging PCs the whole time. wmic product get name — the classic "list installed programs" line from a decade of tutorials — queries a WMI class called Win32_Product, and Microsoft’s own documentation has warned for years that merely listing that class makes Windows Installer run a consistency check on every installed program… and automatically repair any it thinks look off. People ran an innocent inventory command and unknowingly triggered reinstall-style repair operations across their software, then wondered why the machine churned for minutes and the event log filled up.

So when you replace it with winget list — instant, complete, side-effect-free — you are not settling for a substitute. You are upgrading. If you’re then in a cleaning mood, our uninstall guide picks up where the list leaves off. Sometimes the tools we’re nostalgic for deserve a little less nostalgia.

The emergency bridge: Microsoft’s own restore package

Now the honest exception, because real life has deadlines. Maybe a payroll add-on, a scanner utility, or a vendor’s agent shells out to wmic internally, the vendor hasn’t shipped a fix, and you cannot rewrite software you don’t own. Microsoft knows this, which is why its removal notice links a temporary mitigation package — a downloadable wmic_dlc.zip that restores wmic functionality for dependent applications and scripts while their makers catch up.

Treat it exactly as named: a bridge, not a home. It exists so nobody’s business stops this month — not so you can avoid the translation table forever. Three honest caveats before you reach for it. First, get it only from Microsoft’s own WMIC-removal support page — a "wmic download" from anywhere else is precisely the kind of bait this moment invites. Second, remember that restoring wmic restores it for attackers too; you are reopening the bricked-up window. Third, put a date on it: note which machine got the bridge and why, chase the vendor’s update, and remove it when the real fix lands. A bridge with no removal date quietly becomes a liability with a familiar name.

For IT admins: the fleet checklist

If you manage more than a handful of machines, the home-user fix above scales — but the discovery problem is different, because your wmic calls hide in places one PC doesn’t have:

1. Sweep the places scripts accumulate: logon scripts in Group Policy (SYSVOL is the classic hiding spot), the scripts share, scheduled tasks pushed by policy, and your RMM or monitoring platform’s custom checks — inventory and monitoring products of a certain age lean on wmic heavily.
2. Detect before it breaks: a short detection script deployed through Intune remediations or your RMM — checking whether wmic.exe exists and grepping your managed script folders for calls — turns next month’s mystery tickets into this week’s known list.
3. Ask your vendors directly. Anything agent-based that predates 2022 deserves the email: "Is your product wmic-free on Windows 11 25H2?" Their answer decides whether you translate, update, or bridge.
4. Deploy the bridge surgically, not fleet-wide. If a critical app needs wmic_dlc.zip, scope it to exactly the machines running that app, document it, and set a review date. Blanket-restoring wmic across a fleet undoes a security win your own detection rules may rely on — plenty of security products flag wmic execution precisely because attackers use it; a fleet where wmic.exe no longer exists is a fleet where that alarm only rings for real.
5. Standardize on Get-CimInstance in new work — not the older Get-WmiObject, which is itself absent from modern PowerShell 7. Translating wmic straight to CIM means never doing this migration a second time.

What about Windows 10 and servers?

Windows 10 still has wmic — deprecated since 2021, but present and working. If your old scripts run only on Windows 10 machines, nothing breaks today. It’s a stay of execution rather than a pardon, though: Windows 10 itself is living on borrowed time through paid Extended Security Updates — our ESU guide covers the real end dates — and any script you keep alive on wmic just postpones a translation you now know is one line per command.

Windows Server runs on its own servicing calendar; the August 2026 removal notice targets Windows 11 (24H2, 25H2, and 26H1). But the deprecation applies platform-wide and the direction is one-way. The practical rule for a mixed environment: write every new script as if wmic does not exist anywhere, because within your hardware’s lifetime, it won’t.

Honest aside: what you really lose

Balance demands admitting what was genuinely good about wmic: it worked in plain Command Prompt with zero ceremony, its terse output pasted cleanly into anything, and twenty-five years of forum answers and tutorials — including our own older guides, which we’ve been updating as they surface — assume it exists. All of that written knowledge now carries an expiry sticker, and there is a real cost to that: the next decade of readers will paste those old commands and hit an error with no explanation. That, frankly, is why this page exists.

But the replacement is not a downgrade dressed up in press-release language — it is simply better, and one command proves it. Run Get-Volume once and compare it with the wmic bytes-in-a-blob output you used to squint at. If PowerShell still feels like unfamiliar territory, our beginner’s PowerShell tutorial is a gentle on-ramp — and honestly, this migration is a fine excuse to finally take it.

One last reassurance, because the error message genuinely does look like something breaking: "'wmic' is not recognized" on a 2026 Windows 11 machine is not corruption, and running repair tools won’t bring it back — SFC and DISM repair files Windows expects to exist, and Windows no longer expects wmic to exist. Save those tools for real damage. This one is just Windows moving on, and now you know exactly how to move with it.

FAQ — WMIC removal, answered straight

Why is wmic not recognized in Windows 11?

Microsoft removed the WMIC tool from Windows 11. New 24H2/25H2 installs never had it, upgrading to 25H2 removes it, and as of August 2026 it is deleted from existing 24H2 and 25H2 machines and gone from the optional-features list. Use PowerShell’s Get-CimInstance instead.

Did a virus delete wmic from my PC?

No — almost exactly the opposite. Microsoft removed it partly because malware and ransomware abused it so heavily. The removal arrived through a normal Windows update, not an infection.

Is WMI being removed too?

No. WMI — the management engine inside Windows — is untouched and remains a core part of the operating system. Only the wmic.exe command-line front-end was removed; PowerShell reaches the same engine.

What is the replacement for wmic?

PowerShell’s CIM cmdlets: Get-CimInstance for queries and Invoke-CimMethod for actions. The pattern is Get-CimInstance Win32_ClassName — the same class names wmic used underneath.

How do I find my Windows product key without wmic?

In PowerShell: (Get-CimInstance -ClassName SoftwareLicensingService).OA3xOriginalProductKey — it reads the same firmware-embedded key the old wmic line did. A blank result means your machine has no embedded key (typed-in key or digital license).

Can I reinstall WMIC as an optional feature?

Not anymore. WMIC was removed from the Feature on Demand catalog in 2026, so Settings and DISM can no longer add it. The only Microsoft-sanctioned route is the temporary wmic_dlc.zip mitigation package linked from its removal notice.

What is wmic_dlc.zip and is it safe?

It is Microsoft’s own temporary bridge that restores wmic functionality for applications that still depend on it. Safe if downloaded from Microsoft’s WMIC-removal support page — and only from there — but meant as a dated stopgap while vendors update, not a permanent opt-out.

How do I download or install WMIC on Windows 11?

You can’t from Settings or DISM anymore — the optional-feature package was withdrawn in 2026. The only legitimate download is Microsoft’s temporary wmic_dlc.zip bridge, linked from its official removal notice. Any other site offering a "wmic download" or "wmic installer" is exactly where malware would love you to get it — skip those, always.

Was the Windows Management Instrumentation service (Winmgmt) removed too?

No. The Winmgmt service you see in services.msc is WMI itself — the engine — and it remains a core, fully supported part of Windows. Leave it running; PowerShell, Task Manager, and countless apps depend on it. Only the wmic.exe command-line tool went away.

Does Windows 10 still have wmic?

Yes. It has been deprecated there since 2021 but still ships and works. The removal applies to Windows 11 — though new scripts should avoid wmic everywhere, since the direction is one-way.

How do I find which of my scripts use wmic?

From your scripts folder: findstr /s /i "wmic" *.bat *.cmd *.ps1 *.vbs lists every file and line. Check Task Scheduler too: schtasks /query /fo LIST /v | findstr /i wmic.

Get-CimInstance vs Get-WmiObject — which should I use?

Get-CimInstance. The older Get-WmiObject still works in Windows PowerShell 5.1 but does not exist in modern PowerShell 7, so translating to it just schedules a second migration.

Why did Microsoft remove WMIC?

Two reasons: legitimate users had a fully modern replacement in PowerShell, and attackers were abusing the preinstalled tool for reconnaissance, spreading across networks, and disabling recovery before ransomware runs. Removing it closed a documented attack path at almost no cost to current workflows.

How do I list installed programs now?

winget list in any terminal. It is faster and more complete than wmic product get name — which also triggered Windows Installer repair operations every time it ran, so retire it happily.

Does the removal affect Windows Server?

The August 2026 removal notice targets Windows 11 versions 24H2, 25H2, and 26H1. Server editions follow their own servicing timeline — but WMIC is deprecated platform-wide, so treat server scripts as next in line and translate them on the same pass.

How do I check my PC’s serial number and model now?

Serial: Get-CimInstance Win32_BIOS | Select-Object SerialNumber. Maker and model: Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer,Model. Both work on Windows 10 and 11.

Will old tutorials with wmic commands ever work again?

On Windows 11, no — and new Windows versions ship without it entirely. When you meet a wmic line in an old guide, translate it with the pattern Get-CimInstance Win32_ClassName; the information the tutorial was after is still there.

How do I kill a frozen program without wmic?

PowerShell: Stop-Process -Name appname -Force. Plain Command Prompt: taskkill /im appname.exe /f. Both survived the cleanup and work everywhere.

Revision note. Written August 26, 2026, against Microsoft’s official WMIC-removal notice and the August 2026 servicing documentation for Windows 11 24H2 and 25H2; the removal reaches remaining machines through the current update wave, so if your PC still answers to wmic today, this page is your head start rather than your postmortem. The translation table sticks to commands people actually typed for two decades — if your favorite is missing, the Get-CimInstance Win32_ClassName pattern almost certainly covers it, and the contact page reaches us if it doesn’t. And if you spent an hour this morning suspecting a virus, running scans, and doubting yourself before landing here: that was the reasonable reaction. A command vanishing from a machine it lived on for twenty-five years should raise an eyebrow. Yours just happened to vanish honorably😌.