WMIC Replacement: PowerShell Equivalents for Every Command

For twenty years, wmic was the fastest way to ask a Windows machine about itself — one line for the serial number, one for the RAM, one for every installed update. Now the same line answers "'wmic' is not recognized as an internal or external command." This is not a broken PATH and not a missing download: WMIC is gone from Windows 11 24H2 and 25H2 — removed by the August 2026 update, and unlike last year, you cannot add it back, because the optional-feature version was retired along with it. Here is the good news hiding inside that dead end: every single thing WMIC did has a PowerShell twin, most of them are one line, and almost all of them give you better output — real dates instead of 20260927081533.500000+330, real objects instead of column soup, and CSV export that doesn't mangle commas. This is the full WMIC replacement reference: the translation mindset, the command-by-command tables for hardware, software, processes, services, networking and users, the remote /node equivalent, the fixes for old batch files, and the honest answers to "can I re-enable it" (no) and "should I download wmic_dlc.zip from that forum" (absolutely not).

The batch file that ran Jake's shop for six years, dead in one update

Jake's phone-repair shop has a ritual: every PC that comes across the counter gets inventory.bat run against it — a six-year-old batch file that pulls the serial number, RAM, disk model and Windows version into a text file that gets stapled (digitally) to the job ticket. Six lines, five of them starting with wmic.

In late September a customer's fresh 25H2 laptop answered all five lines the same way: 'wmic' is not recognized as an internal or external command, operable program or batch file.

Jake did what everyone does. He searched the error, found a year-old forum thread, and followed it to Settings to install "WMIC" from optional features. The feature wasn't in the list. A newer thread offered a download — wmic_dlc.zip, hosted nowhere near Microsoft. His cursor hovered over it long enough to feel wrong, and he called Ethan instead.

"Close the tab," Ethan said. "That zip is someone's guess at best and someone's payload at worst. WMIC isn't misplaced — Microsoft removed it. This summer's update took it out of 24H2 and 25H2 for good, and the optional feature went with it. There is no legitimate wmic download. There never was."

"So my inventory file is just... dead?"

"Your inventory file needs a translator, not a resurrection. Every wmic line has a PowerShell equivalent. Give me ten minutes."

It took eight. The new inventory.ps1 pulled the same five facts, plus the last-boot time Jake had always wanted but never added because parsing WMIC's timestamp format was miserable — PowerShell hands it over as a real date. The old file asked a dead tool five questions; the new one asks the same database the dead tool used, because WMI itself never went anywhere. Only the command-line wrapper died. That distinction is the whole story, and it is why this translation is mechanical rather than painful.

WMIC is gone for real: the timeline, and what "removed" means

The confusion around this tool comes from its long goodbye. The stages, so you can place whatever machine is in front of you:

So the answer to "wmic will not install on Windows 11" depends entirely on the build: on early 24H2 builds the optional feature existed and our wmic is not recognized fix walks through enabling it; on a machine patched past August 2026, the install path is gone and the only way forward is translation. Check where you stand with winver.

Three facts anchor everything else in this guide:

• WMI survives. Windows Management Instrumentation — the actual database of hardware and system information — remains a core part of Windows. Every query WMIC ever ran still works; you just address the database through PowerShell now.
• The removal is permanent and policy-free. There is no registry key, group policy or optional feature that restores wmic.exe on a current build. Anyone claiming otherwise is describing an older build or offering you a file you should not run.
• wmic_dlc.zip and "wmic download for Windows 11" are traps. A system utility copied out of an old Windows or repacked by a stranger is untrusted code running with your rights, aimed at exactly the audience (admins, tinkerers) most worth compromising. The real replacement is already installed on every Windows machine you will ever touch.

The translation mindset: five rules that convert any wmic command

Memorize these five rules and you can translate commands this guide never mentions:

1. Alias → class. Every wmic alias (os, cpu, bios...) is a friendly name for a WMI class, almost always Win32_Something. Get-CimInstance -ClassName Win32_OperatingSystem is wmic os with its formal name. The tables below carry the full mapping. For anything exotic, wmic path Win32_Whatever was already using class names — Get-CimInstance Win32_Whatever is a straight swap.
2. get → Select-Object. wmic bios get serialnumber becomes Get-CimInstance Win32_BIOS | Select-Object SerialNumber. Leave off the Select to see every property — the fastest way to discover fields wmic never showed you.
3. where → -Filter. wmic process where "name='chrome.exe'" becomes Get-CimInstance Win32_Process -Filter "name='chrome.exe'" — same quoting style inside the filter, which makes old commands port almost verbatim.
4. call → Invoke-CimMethod (or a friendlier cmdlet). wmic process where "name='notepad.exe'" call terminate becomes Stop-Process -Name notepad in practice, or the literal Get-CimInstance Win32_Process -Filter "name='notepad.exe'" | Invoke-CimMethod -MethodName Terminate when you want the exact WMI behavior.
5. /node:PC → -ComputerName PC (or a CimSession for anything serious — the remote section explains when each is right).

One naming note before the tables: you will find years of advice using Get-WmiObject (gwmi). It produces similar results, but it is itself deprecated — it exists only in Windows PowerShell 5.1 and is absent from PowerShell 7 — and it speaks DCOM only. Get-CimInstance is the one Microsoft points at as the WMIC replacement and the one this guide uses throughout; learning the old cmdlet in 2026 is learning a second dead tool.

Hardware queries: the table

Two upgrades you get free. Sizes come back as raw bytes in both tools, but PowerShell can do the division inline: Get-CimInstance Win32_LogicalDisk | Select-Object Name, @{n='FreeGB';e={[math]::Round($_.FreeSpace/1GB,1)}} gives a human column WMIC could never produce. And where WMIC's memorychip output wrapped into unreadable columns on a four-stick machine, PowerShell's default table just... fits, and Format-List is there when it doesn't.

System, updates and installed software: the table

The LastBootUpTime row is the quiet star: WMIC returned 20260927081533.500000+330 and left the parsing to you; Get-CimInstance returns a real DateTime you can subtract — (Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime is your uptime, done.

The wmic product warning deserves its box: querying the Win32_Product class — with either tool — is famously harmful on production machines, because merely listing it makes Windows Installer run a consistency check on every MSI package, which is slow and can trigger repair actions. It also only ever saw MSI-installed software. The honest replacements: winget list for a complete quick inventory, or reading the uninstall registry keys directly when you need it scriptable:

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
                 "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object DisplayName | Select-Object DisplayName, DisplayVersion, Publisher

That one-liner sees everything the Settings app sees — MSI, EXE installers, the lot — and touches nothing while looking. If your old script did wmic product where name="X" call uninstall, the modern path is winget uninstall "X", with the registry key's UninstallString as the fallback for stubborn cases.

Processes and services: the table

Note the split personality, and use it: Get-Process and Get-Service are the comfortable everyday tools, but they don't expose everything WMI knows. The command line a process was started with — the field that makes wmic process get commandline a support-forum staple, because it tells you which of nine svchost.exe or officec2rclient.exe instances you are looking at — lives in Win32_Process, not in Get-Process. Same for a service's logon account (StartName). Rule of thumb: reach for the friendly cmdlet first, drop to Get-CimInstance when you need the deep fields.

Network and users: the table

One old landmine gets defused for free here: on a domain-joined machine, wmic useraccount without a where clause tried to enumerate the entire domain's accounts and could hang for minutes; Get-LocalUser asks only the local machine, which is what almost everyone meant. (When you genuinely want domain objects, that is Active Directory's own module's job, not WMI's.) For the fuller picture of local accounts — enabled state, password ages, group memberships — our user accounts guide goes deeper than any one-liner.

Disks, partitions and drive health: where the replacement is an upgrade

Storage is the one area where translating wmic literally sells you short, because PowerShell grew a whole Storage module that speaks in the objects you actually think in — disks, partitions, volumes — instead of WMI's 2003-era view of them:

The last row is the recruitment pitch. Get-PhysicalDisk | Select-Object FriendlyName, MediaType, HealthStatus answers "is this an SSD and is it dying" in one line — questions wmic users answered with third-party tools. And when a drive starts throwing warnings, Get-PhysicalDisk | Get-StorageReliabilityCounter | Select-Object Wear, ReadErrorsTotal, Temperature reads the drive's own reliability counters, which is the closest built-in Windows gets to a SMART report. A failing disk conversation that used to require downloading something now starts with two lines that are already on every machine — and the right day to run them is before the drive gets a vote, which is also the argument for having File History already on when the counters turn ugly.

The complete alias dictionary: every wmic alias and its class

The tables above cover the commands people type weekly. This one is the reference for everything else — each wmic alias and the class Get-CimInstance wants for it. Aliases marked with a cmdlet have a friendlier native tool that beats raw CIM for daily use:

Print it, pin it, or just remember that the mapping is guessable: the alias plus Win32_ in CamelCase gets you there nine times out of ten, and Get-CimClass Win32_*keyword* searches the class catalog for the tenth — Get-CimClass battery finds Win32_Battery without any table at all. That discovery command is itself a thing wmic never had.

The 20-minute on-ramp for people who lived in cmd

If wmic's removal is what finally pushes you into PowerShell, four habits repay the switching cost almost immediately:

• Tab completes everything. Type Get-CimInstance Win32_Bi and press Tab; type - after a cmdlet and Tab cycles its parameters. Half of wmic's difficulty was remembering exact alias and field names; here the shell remembers for you.
• Get-Member shows what you're holding. Get-CimInstance Win32_BIOS | Get-Member lists every property the object carries — the fields wmic's default output hid from you. This is how you discover that Win32_OperatingSystem knows the install date, the last boot, and the exact build in one query.
• The shortcuts exist once you know them. gcim is Get-CimInstance, gsv is Get-Service, gps is Get-Process — so gcim Win32_BIOS is barely longer than the wmic it replaces. (In your own saved scripts, spell cmdlets out; future readers, including you, will thank you.)
• Old friends still work. ipconfig, ping, netstat, systeminfo all run unchanged inside PowerShell — switching shells doesn't confiscate your vocabulary, it extends it. For the bigger picture of what a modern admin prompt can pull about a machine, our System Configuration guide walks the full inventory toolkit, PowerShell included.

The ten one-liners people actually came here for

Bookmark section. The exact modern line for the ten most-searched wmic jobs:

1. Serial number / service tag: Get-CimInstance Win32_BIOS | Select-Object SerialNumber
2. Windows product key (OEM, from firmware): (Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey — blank on retail/volume machines whose key never lived in firmware; that blank is honest, not broken.
3. Model and manufacturer: Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model
4. RAM sticks, sizes and slots: Get-CimInstance Win32_PhysicalMemory | Select-Object BankLabel, Capacity, Speed
5. Uptime: (Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime
6. Installed updates, newest first: Get-HotFix | Sort-Object InstalledOn -Descending
7. Free disk space in GB: Get-CimInstance Win32_LogicalDisk -Filter "DriveType=3" | Select-Object Name, @{n='FreeGB';e={[math]::Round($_.FreeSpace/1GB,1)}}
8. BIOS/UEFI version: Get-CimInstance Win32_BIOS | Select-Object SMBIOSBIOSVersion, ReleaseDate — the modern twin of our old find your BIOS version trick.
9. Which process holds a command line containing X: Get-CimInstance Win32_Process | Where-Object CommandLine -like "X" | Select-Object ProcessId, Name, CommandLine
10. Installed software, quick and safe: winget list (or the registry one-liner from the software table)

Every one of these runs in Windows PowerShell 5.1 (preinstalled everywhere) and PowerShell 7 alike, from a normal prompt — only the deeper system actions (stopping services, killing others' processes) want an elevated window, same as always. If cmd is where you live, prefix any of them with powershell -command and stay home: powershell -command "Get-CimInstance Win32_BIOS | Select-Object SerialNumber" works in the same black window wmic did.

Making PowerShell output look the way wmic did

WMIC muscle memory is mostly output-format memory. The dictionary:

The habit worth actually changing: wmic pipelines were text pipelines, so you trimmed columns with findstr and prayed about commas. PowerShell pipelines carry objects until the last step — filter with Where-Object, pick columns with Select-Object, and only format at the very end. It is the difference between editing a printout and querying the data, and it is why the CSV that comes out of Export-Csv opens clean in Excel while WMIC's /format:csv output was a folklore of workarounds.

Fixing the old batch files and scripts

The three patterns that repair almost any wmic-dependent script:

Pattern 1 — the script just runs wmic and shows/saves output. Replace each wmic line with powershell -command "..." carrying the translated command. The batch file stays a batch file; only the engine under the hood changes. Jake's inventory.bat was this pattern five times over, which is why it took eight minutes.

Pattern 2 — for /f parses wmic output into a variable. The old idiom for /f "skip=1" %%a in ('wmic bios get serialnumber') do ... was always fragile (trailing carriage returns, that skipped header). The modern form asks PowerShell for exactly the value, no parsing:

for /f "usebackq delims=" %%a in (`powershell -command "(Get-CimInstance Win32_BIOS).SerialNumber"`) do set SERIAL=%%a

PowerShell prints the bare value, cmd captures it, and the carriage-return gremlin dies with the header line.

Pattern 3 — the script is big enough to deserve a real port. If the file is more wmic than glue, rewrite it as a .ps1 and reclaim twenty years of pain: no header-skipping, real error handling with -ErrorAction, values that are numbers and dates instead of strings. Scheduled tasks run .ps1 files happily with powershell -ExecutionPolicy Bypass -File script.ps1 as the action.

The pattern to refuse: do not fake a wmic.exe — a shim script named wmic.bat on the PATH that translates arguments. It feels clever, it half-works, and it leaves a booby trap for every future tool, script and colleague that probes for the real thing. Dead tools should stay visibly dead; translated scripts document themselves.

The /node replacement: remote queries done properly

wmic /node:"PC-07" bios get serialnumber had one job — asking another machine — and the modern replacements do it two ways:

Quick and occasional: most CIM commands take a computer name directly. Get-CimInstance Win32_BIOS -ComputerName PC-07 | Select-Object SerialNumber. This rides on WinRM (PowerShell remoting), which is enabled by default on servers but usually off on client Windows — the one-time Enable-PSRemoting on the target (or the equivalent GPO/Intune policy across a fleet) is the price of entry, and the "RPC server is unavailable"-style errors people hit here are almost always that switch, not their command.

Repeated or many machines: open sessions once and reuse them:

$s = New-CimSession -ComputerName (Get-Content .\hosts.txt)
Get-CimInstance Win32_BIOS -CimSession $s | Select-Object PSComputerName, SerialNumber
Get-CimInstance Win32_LogicalDisk -CimSession $s -Filter "DriveType=3" |
  Select-Object PSComputerName, Name, FreeSpace
Remove-CimSession $s

Each query hits every machine in the session list in parallel and comes back tagged with PSComputerName — a fleet inventory in four lines, which is the moment most people stop missing wmic entirely. Old machines or odd network zones that only speak the legacy protocol can still be reached by creating the CimSession over DCOM (-SessionOption (New-CimSessionOption -Protocol Dcom)), which is the escape hatch wmic users never knew they were already depending on.

For IT admins: hunting wmic across an estate before it hunts you

The removal turns every forgotten wmic reference into a future incident, and the estate always has more of them than anyone remembers. The sweep, in order of where they hide:

1. The scripts you know about. Logon scripts, the NETLOGON share, the "tools" folder every fleet accretes:

Get-ChildItem \\yourdomain\NETLOGON, D:\Scripts -Recurse -Include *.bat,*.cmd,*.ps1,*.vbs |
  Select-String -Pattern '\bwmic\b' -List | Select-Object Path

2. Scheduled tasks. The classic hiding place — a task created in 2019 by someone who left in 2021:

Get-ScheduledTask | ForEach-Object {
  $a = $_.Actions | Where-Object { "$($_.Execute) $($_.Arguments)" -match '\bwmic\b' }
  if ($a) { [PSCustomObject]@{Task=$_.TaskName; Path=$_.TaskPath; Action="$($a.Execute) $($a.Arguments)"} }
}

Run it through Invoke-Command across the fleet and collect the CSV; the result is your migration worklist, usually short and always surprising.

3. GPO-deployed commands. Startup/shutdown/logon script assignments and any "run this command" preference item — searchable by exporting GPO reports (Get-GPOReport -All -ReportType Xml) and string-matching for wmic.

4. Monitoring and inventory products. Anything that "collects hardware inventory" via custom scripts. The commercial tools (Configuration Manager's hardware inventory, Intune's device inventory) query WMI natively and never cared about wmic.exe — it is the homegrown glue that breaks.

The security paragraph your CISO already knows: wmic.exe spent a decade on every living-off-the-land binary list — attackers used it for reconnaissance, process call create execution, /node lateral movement, and the notorious shadowcopy delete that precedes ransomware detonation. Its removal is a genuine attack-surface win and one less LOLBin to watch. The flip side for defenders: detection rules keyed on wmic.exe command lines go quiet, while the same tradecraft moves to PowerShell CIM — so the SIEM rules worth having now watch Invoke-CimMethod with Win32_Process/Create patterns, remote CimSession creation from unexpected sources, and Win32_ShadowCopy deletions, in PowerShell script-block logs (Event ID 4104) rather than process-creation logs alone. If your estate still runs builds where wmic exists, its presence in fresh process logs is itself increasingly a signal: legitimate use is migrating away, so what remains skews interesting.

The migration checklist, compressed: inventory references (sweeps 1-3) → classify by pattern (the three batch patterns above) → translate with the tables in this guide → test on current builds → deploy → add a CI-style lint (Select-String '\bwmic\b') to whatever pipeline touches your script repos, so the count only ever goes down. Budget reality: most estates find a dozen scripts, one afternoon each, and the fleet-wide CimSession patterns usually leave the replacements faster than the originals.

WMIC replacement: FAQ

What is replacing WMIC?

PowerShell's Get-CimInstance cmdlet is Microsoft's designated replacement for querying, with Invoke-CimMethod for actions and friendly cmdlets (Get-Process, Get-Service, Get-HotFix, Get-LocalUser, Get-NetAdapter) covering the everyday cases. The underlying WMI database is unchanged — only the wmic.exe wrapper is gone.

Why does "wmic command not working" suddenly happen on Windows 11?

Because the tool was removed: Windows 11 24H2 and 25H2 lost wmic.exe via the August 2026 servicing update, and 26H1 never had it. On slightly older 24H2 builds it existed as an optional feature that wasn't installed by default — that era, and its fix, is covered in our dedicated "wmic is not recognized" guide.

Can I re-enable WMIC on Windows 11 25H2?

No. On builds patched past August 2026 the Feature on Demand is retired — the optional-features list has nothing to install, and no policy or registry setting restores it. The translation tables in this guide are the way forward.

Is there a WMIC download for Windows 11? What about wmic_dlc.zip?

There is no legitimate standalone download and never has been — files like wmic_dlc.zip on forums and driver sites are repacked system files at best and malware at worst. A system administration tool from an untrusted source is the single worst category of file to run.

What is the WMIC command, for someone maintaining old documentation?

WMIC (Windows Management Instrumentation Command-line) was the console front-end to WMI from Windows XP through Windows 11's early builds — the wmic os get version style of query. Documentation that references it should now show the Get-CimInstance equivalents; this page is the mapping.

Is WMIC deprecated or removed?

Both, in sequence: deprecated for years, then removed — gone from Windows 11 24H2/25H2 as of the August 2026 update and absent from 26H1 onward. On supported Windows 10 builds it still exists, deprecated, for whatever remains of that runway.

What is the replacement for "wmic bios get serialnumber"?

Get-CimInstance Win32_BIOS | Select-Object SerialNumber — or, capturing just the value in a script, (Get-CimInstance Win32_BIOS).SerialNumber.

How do I get my Windows product key now that wmic is gone?

(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey returns the key embedded in the firmware of OEM machines. If it returns nothing, your key was never stored there (retail and volume licenses) — that blank is the true answer, not a failure, and no third-party "key finder" changes it.

Get-WmiObject or Get-CimInstance — which should I learn?

Get-CimInstance. Get-WmiObject is itself deprecated, only exists in Windows PowerShell 5.1 (PowerShell 7 dropped it), and speaks only DCOM. The syntax differences are small; the future-proofing is not.

Is Get-CimInstance slower than wmic was?

No meaningful difference for local queries — both ask the same WMI service. Remote fleets are where the modern tool pulls ahead: parallel CimSessions across dozens of machines beat serial /node calls by a wide margin.

Do these commands need administrator rights?

Reading local information — serials, RAM, disks, processes, updates — works from a normal prompt. Elevation is for actions (stopping services, killing other users' processes) and some security-sensitive classes; remote queries need WinRM enabled on the target plus rights there, exactly as /node needed in its day.

What replaced "wmic qfe" for checking installed updates?

Get-HotFix, one to one: Get-HotFix -Id KB5129195 checks a specific update, and Get-HotFix | Sort-Object InstalledOn -Descending lists the history. Handy in months like September 2026, when knowing whether the out-of-band fix landed actually matters.

How do I uninstall software from the command line without wmic product?

winget uninstall "App Name" is the modern front door. For scripted edge cases, read the app's UninstallString from the registry uninstall keys and run that. Avoid Win32_Product queries entirely — listing that class makes Windows Installer validate every MSI on the machine, a famous foot-gun that predates the removal by a decade.

Does WMIC removal affect Windows 10?

No — Windows 10 keeps its deprecated-but-present wmic.exe. The removal story is Windows 11 24H2/25H2 (August 2026 servicing) and 26H1. Scripts that must straddle both worlds during migration should just use the PowerShell forms, which run identically on Windows 10.

My monitoring tool broke after the update removed WMIC — what do I tell the vendor?

That wmic.exe is removed from current Windows 11 and their collector needs to query WMI natively or via PowerShell CIM. Mainstream inventory products made that move years ago; a tool that shells out to wmic in 2026 is telling you something about its maintenance.

What replaced "wmic /output:file.csv" for saving results?

Pipe to Export-Csv for spreadsheets (Get-HotFix | Export-Csv updates.csv -NoTypeInformation) or Out-File for plain text. Unlike wmic's /format:csv, Export-Csv quotes fields properly, so commas in values stop corrupting columns.

Is there a shorter way to type Get-CimInstance?

Yes — gcim is its built-in alias, so gcim Win32_BIOS works anywhere and is barely longer than wmic bios. Interactive shortcuts are fair game at the prompt; in saved scripts, spell the full cmdlet for readability.

Was removing WMIC actually good for security?

Genuinely, yes: wmic.exe was a fixture of attacker tradecraft — reconnaissance, remote execution, and deleting backup shadow copies before ransomware runs. Removing it doesn't end those techniques (PowerShell reaches the same WMI), but it kills the most convenient, most script-kiddie-friendly path, and defenders get one less always-present binary to monitor.

If a tool you typed for twenty years just vanished out from under your fingers, you are allowed to be annoyed — Jake certainly billed his annoyance to Microsoft under his breath while Ethan typed. But this particular funeral comes with an inheritance: the replacement is already on every machine you manage, it hands you real dates and real objects instead of column soup, and the remote version is honestly better than the thing it buried. Translate the commands you use, once, with the tables above, and keep this page for the ones you use next year. If you hit a wmic command this guide doesn't map, tell me through the contact page and it will be added — this is a living reference.