Microsoft Quietly Removes SaRA Command-Line Tool from Windows
Microsoft officially deprecated and removed the Support and Recovery Assistant (SaRA) command-line utility from all supported Windows versions on March 10, 2026. The removal affects Windows 10, Windows 11, and Windows Server editions that receive regular security updates. IT administrators discovered the change when attempting to deploy automated troubleshooting scripts that relied on the SaRA command-line interface.
The Support and Recovery Assistant served as Microsoft's primary automated diagnostic tool for Office 365, Outlook, and Windows-related issues since its introduction in 2016. The command-line version allowed system administrators to integrate SaRA's diagnostic capabilities into PowerShell scripts, batch files, and enterprise management systems. This automation proved essential for large organizations managing thousands of endpoints where manual troubleshooting wasn't feasible.
Microsoft's decision comes as part of a broader strategy to consolidate diagnostic tools under the Microsoft 365 Admin Center and Azure-based management platforms. The company hasn't provided a direct replacement for the command-line functionality, leaving enterprise customers to seek alternative solutions. The Microsoft Security Response Center confirmed the deprecation affects all Windows builds released after March 2026.
The removal process began with Windows Update KB5035942 for Windows 11 and KB5035941 for Windows 10. These updates silently removed the SaRA executable files from the System32 directory without displaying removal notifications to users. Server administrators running Windows Server 2019, 2022, and the preview builds of Windows Server 2025 also lost access to the tool through their respective cumulative updates.
Enterprise customers who relied heavily on SaRA's command-line interface for automated Office 365 troubleshooting now face significant operational challenges. The tool's ability to diagnose Exchange Online connectivity issues, SharePoint authentication problems, and Teams meeting failures made it indispensable for many IT departments. Without the command-line version, administrators must resort to manual troubleshooting or develop custom diagnostic scripts.
Windows Administrators Lose Critical Automation Tool
The SaRA removal primarily impacts enterprise IT departments, managed service providers, and system administrators who integrated the command-line utility into their automated workflows. Organizations running Windows 10 version 21H2 and later, Windows 11 all versions, Windows Server 2019, Windows Server 2022, and Windows Server 2025 preview builds lost access to the tool through their March 2026 cumulative updates.
Large enterprises with complex Office 365 deployments face the most significant disruption. Companies that automated SaRA diagnostics through System Center Configuration Manager, Microsoft Intune, or third-party RMM platforms must now redesign their troubleshooting procedures. Financial services, healthcare, and government organizations that relied on SaRA for compliance-related diagnostic reporting will need to identify alternative solutions quickly.
Small and medium businesses using SaRA through PowerShell scripts for routine maintenance tasks also lost this capability. The tool's removal affects approximately 1.3 billion Windows devices worldwide, though the actual impact varies based on how organizations utilized the command-line interface. Home users remain largely unaffected since they typically used the graphical version of SaRA, which Microsoft continues to support through the Microsoft 365 Admin Center.
Managed service providers who built automated diagnostic workflows around SaRA's command-line capabilities must now invest in developing custom solutions or purchasing third-party diagnostic tools. This transition period creates potential service delivery gaps for MSPs managing multiple client environments where SaRA provided standardized troubleshooting procedures.
Migration Path and Alternative Solutions for IT Teams
Microsoft recommends organizations transition to PowerShell-based diagnostic cmdlets available through the Exchange Online Management module and Microsoft Graph PowerShell SDK. The Exchange Online Management module provides Get-ConnectionInformation, Test-OutlookConnectivity, and other cmdlets that replicate some SaRA functionality. System administrators can install these modules using 'Install-Module ExchangeOnlineManagement' and 'Install-Module Microsoft.Graph' commands in elevated PowerShell sessions.
For Office 365 connectivity testing, administrators should implement the Microsoft 365 network connectivity test available through the Microsoft 365 Admin Center API. This browser-based tool provides similar diagnostic capabilities but requires manual intervention rather than automated scripting. Organizations can access these diagnostics programmatically through Microsoft Graph API calls, though this requires additional development work to replicate SaRA's automated reporting features.
The CISA Known Exploited Vulnerabilities catalog doesn't list any security concerns related to SaRA's removal, indicating Microsoft's decision stems from product strategy rather than security issues. However, organizations should audit their existing scripts and automation workflows to identify dependencies on the removed SaRA command-line utility.
IT departments should immediately inventory their PowerShell scripts, Group Policy startup scripts, and scheduled tasks that reference 'SaRACmd.exe' or 'SupportAssistant.exe'. These scripts will fail silently after the March updates, potentially disrupting automated maintenance routines. Microsoft suggests replacing SaRA-dependent workflows with Microsoft 365 Service Health Dashboard monitoring and Azure Monitor-based alerting systems for proactive issue detection.
