0

How to block WMIC on servers, but WMI should remain enabled.

And how we can test that WMIC has been disabled, we want to disable WMIC from GPO via domain controller.

Improve this question

1 Answer 1

Reset to default
0

Microsoft is moving forward with removing the Windows Management Instrumentation Command-line (WMIC) tool, wmic.exe. Starting with Windows 11 build 22572, WMIC is no longer available in Windows 11 builds, except as an optional feature that can be uninstalled or reinstalled via Settings > Apps > Optional Features.

For an older Windows version, in your case Windows Server 2012, WMIC might still be necessary for routine Windows tasks. In any case, anything that WMIC does can equally be done using PowerShell, so that WMIC is not the only danger-point in case of infection.

You may try brute force, by renaming the WMIC executables at C:\Windows\System32\wbem\WMIC.exe and C:\Windows\SysWOW64\wbem\WMIC.exe. However, ensure that you can at least reboot in Safe mode, and have available a USB Windows Recovery disk and a USB Windows installation media, just in case.

Improve this answer
2
  • As per my knowledge, WMI is important for any type of installation, etc but WMIC can be disabled on servers, can you please tell me how only to disable WMIC on servers?
    – Hussain Arif
    Jun 27, 2022 at 9:57
  • You can't disable it, only to sabotage it by removing the wmic front-end. Only by trying you can see what effect this will have on Windows. This is why I counsel being careful and ensuring that you have the tools to undo this change, just in case.
    – harrymc
    Jun 27, 2022 at 10:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .