Remove WMIC dependency in Fleet per 25H2 Windows update

[nonpunctual]

Problem

There is 1 dependency in the Fleet repo calling WMIC directly. Per @zwass:

Zach Wasserman
1 dependency there in the Fleet repo by direct searching (the second is a false positive). Osquery itself should be unaffected as it uses WMI directly and not wmic.

Brock Walters
So [@zach Wasserman] so this needs to be updated?

Zach Wasserman
Yes

Brock Walters
so is it ok to just make FR saying this needs to be researched / updated?

George Karr
yes perfect!

Please see:

fleet/orbit/pkg/platform/platform_windows.go

Line 229 in cbde3f7

args := []string{"/C", "wmic csproduct get UUID"}

Research may need to be done on how to replace this command. According to the internet, there should be a modern PowerShell equivalent: https://powershellisfun.com/2025/10/08/windows-11-25h2s-removal-of-wmic-and-the-powershell-alternative/

In addition to this research we may want to look into the following:

• Is the WMI api used in osquery tables affected by the updates?
• PowerShell 2.0 is also deprecated in Windows 11 25H2? Is there anything in Fleet reliant on specific PowerShell 2.0 commands? How can these be discovered?

ATTN: @noahtalerman this FR was requested by @georgekarrv - thanks.

Potential solutions

Change WMIC commands & PowerShell 2.0 commands to modern PowerShell equivalents.

What is the expected workflow as a result of your proposal?

Fleet will be compatible with Windows 11 25H2 updates.

[noahtalerman]

Hey @lukeheath I think this is a good candidate for an engineering-initiated story so I moved it to the ~engineering-initiated queue.

@georgekarrv do you know what the urgency is? When do we have to do this by?