WMIC Deprecation

[ThioJoe]

WMIC Deprecation

[ThioJoe]

Ah ok I see. Yea again not a huge deal since the program still works and probably doesn't affect many users, but figured I'd mention it.

To reproduce you wouldn't necessarily need to enable smart app control or Windows Defender Application Control (SAC is basically a special made policy using WDAC). Any method that 'blocks' it from running could work. The thing about Smart App Control is Microsoft decided to make it so you can only enable it immediately after a clean install of Windows, and if you ever disable it you can't enable it again.

The easier way I'm aware of would be using AppLocker which is a feature built into Windows 10/11 Pro (it uses Group Policy Editor which isn't in Home edition). AppLocker is a whitelisting feature that is the predecessor to WDAC but a lot easier to set up. It basically just lets you restrict what can run on the system by letting you create rules where something can only run if you create a specific rule to allow it, but you can also create rules to block specific stuff too. So you can just make a rule to block wmic.exe to test.

Here's a simple walkthrough which should be the fastest way to reproduce. The steps are simple but I'll add some contextual info that might make it seem more complicated than it is.

1. Open Group Policy Editor (Just search the start menu for gpedit.msc )

2. In the group policy editor to go: Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker > Executable Rules

Then in the right side there won't be any executable rules yet, so AppLocker won't be active until there's at least one. Before creating a rule to block wmic.exe you'll want to create a rule to just allow all exe's so it doesn't interfere with the rest of your system. Basically with applocker active (meaning there's at least one rule), a program can only run if there is a rule explicitly allowing it. So if you were to just go and create a wmic.exe blocking rule, actually it wouldn't allow any other exes to run without making a rule to allow them, so we can just do that first.

3. In the right hand side with executable rules selected, right click and hit 'create new rule' > Keep 'Allow' selected and hit 'Next' > Then select 'Path' and hit next > In the path box, just simply put an asterisk ( * ) and hit next > on exceptions page just hit next > Then you can name the rule whatever you want and hit Create.

See here as an example:

Create.wildcard.rule.mp4

That basically creates a rule that just allows any exe to run, which in your case where AppLocker wasn't enabled before, will actually mean it will make no difference, since without AppLocker everything was allowed by default anyway.

5. Next right click to create another rule, but this time on the permissions page select "Deny" action > Then select 'Path' type rule like before > then in the path box this time put *\wmic.exe . (Note it has to be a backslash, it wont let you put a forward slash) then hit next > Again on the exceptions page hit next without changing anything > Then name the rule whatever you want and hit Create.

Now you'll have 2 rules, one allowing all exe's, but one blocking wmic.exe, but Deny rules always overrule the Allow rules so now it effectively only blocks wmic.exe from running. If you delete all the rules it should just revert to disabling AppLocker altogether.

6. One possible thing you might have to do, is back on the left side of the window with the tree (where Executable Rules was selected), right click "AppLocker", click "Properties", then where it has the Executable Rules "Configured" check box, check that and in the dropdown hit "Enforce Rules" and hit OK.

This step might not even be necessary but worth knowing about. In the dropdown you can also select "Audit Only" if you want to disable AppLocker without having to delete the rules.

Also note that there are other sections like 'Windows Installer Rules' and 'Script Rules'. Those all get activated independently, so as long as you don't create any rules in there they won't be affected so you don't have to worry about those.

---

As a side note, if you happen to be interested in learning everything else about AppLocker I also made a huge tutorial here, but that is definitely overkill for this purpose lol.

[openspeedtest]

@dw5 Also check firewall rules.

[openspeedtest]

OpenSpeedTest-Server is an Electron app that utilizes the "internal-ip" package to ascertain the system's IP address. This "internal-ip" package, in turn, relies on a dependency known as "default-gateway," which employs "wmic."

A discussion regarding this issue is underway within the "default-gateway" repository. A proposed solution using PowerShell has been submitted in the form of a pull request, but it has yet to be merged.

Should "default-gateway" rectify this issue, we can proceed with updating the apps accordingly. However, if the issue persists, we shall address it in the subsequent major release by either forking "internal-ip" and implementing a fix ourselves or opting for an alternative package that functions without "wmic."

To reproduce this issue, we need to enable Smart App Control, correct? I am going to replicate this and explore other options that can be used to fix this issue as soon as possible.

[openspeedtest]

@ThioJoe I reproduced this issue; I enabled SmartAppControl, and everything worked fine. However, after a Windows update, I encountered the same error as you did. I modified the default-gateway package using the changes from the deleted pull request, and it is working on my machine. I need to test this on Windows 10, etc. I have not bumped up the version number. As I mentioned, I need more testing.
https://openspeedtest.com/downloads/OpenSpeedTest-Server%202.1.8-PowerShell.exe

[openspeedtest]

Your Must have a default gateway and IP addresses
wmic issue is very rare. If that is the problem try https://openspeedtest.com/downloads/OpenSpeedTest-Server%202.1.8-PowerShell.exe