Windows 11 has finally deleted the tool ransomware used to wipe your restore points

There's a command-line tool that has shipped with Windows since the XP era, called WMIC. If you've never heard of it, that's rather the point. It existed so administrators could query hardware and system settings from a script, and no home user ever had a reason to open it. Attackers had several.

Microsoft has been backing away from it for a decade - first marked deprecated in 2016, deprecated again in Windows 10 21H1, demoted to an optional add-on in Windows 11 22H2, then switched off by default in 24H2. Microsoft's own documentation now states the tool "will be completely removed from Windows 11" and "will not be available as a Feature on Demand (FoD)." Windows Latest reports the August 2026 update finished the job on 24H2 and 25H2 machines: it's gone, and unlike every previous stage, there's no putting it back. The underlying plumbing, WMI itself, stays exactly where it was.

The reason this counts as a security fix is a tactic called living off the land. Rather than smuggle in their own program, which antivirus might spot, criminals use one Microsoft already signed and shipped. Ransomware families used WMIC to delete Windows' Shadow Volume Copies - which is precisely why so many victims found "restore previous versions" sitting empty when they finally went looking. Other malware used it to list the installed antivirus, uninstall it, or quietly add itself to Defender's exclusions.

There's nothing for you to do here, which makes a pleasant change. But hold on to the shadow-copy detail, because it explains something people get wrong constantly: those snapshots were never a backup. They lived on the same disk as the files they were meant to protect, and a single command could erase the lot.

A copy on a different drive is the only kind that survives a bad day. Tendvane's one-click backup copies your Documents, Pictures and Desktop somewhere else - an external drive, ideally one you unplug when it's finished.