Prepare for the removal of WMIC from Windows 11

🚨 The Signal: WMIC, a legacy command-line utility, is being removed from Windows 11 versions 24H2 and later. This change enhances security by eliminating an outdated tool often exploited by attackers, requiring migration to PowerShell for system management.

The Impact

System administrators and security teams are affected, facing a moderate risk of operational disruption if WMIC-dependent scripts are not updated.

• System administrators: Operational disruption from failed scripts.
• Security teams: Reduced attack surface from WMIC removal.
• DevOps teams: Need to update automation pipelines.
• Monitoring teams: Potential loss of system telemetry.

The Action

1. Identify all scripts, applications, and tools using WMIC.
2. Prioritise migration of critical WMIC dependencies to PowerShell.
3. Test updated scripts and applications in a controlled environment.
4. Deploy updated tooling to production systems.
5. Verify continued functionality of system management and monitoring.

Domain: Intune · Impact: medium · Workload: Other · Essential Eight: Patch Operating Systems, User Application Hardening · ISM: ISM-1407, ISM-1412, ISM-1485, ISM-1486, ISM-1501, ISM-1542, ISM-1585, ISM-1621, ISM-1622, ISM-1623, ISM-1654, ISM-1655, ISM-1667, ISM-1668, ISM-1669, ISM-1670, ISM-1694, ISM-1695, ISM-1696, ISM-1701, ISM-1702, ISM-1823, ISM-1824, ISM-1859, ISM-1860, ISM-1877, ISM-1889, ISM-1902