diff --git a/go.mod b/go.mod
index 4c2145a3afd93..d0da31186908c 100644
--- a/go.mod
+++ b/go.mod
@@ -185,6 +185,7 @@ require (
 	github.com/ucarion/urlpath v0.0.0-20200424170820-7ccc79b76bbb
 	github.com/vulcand/predicate v1.2.0 // replaced
 	github.com/xanzy/go-gitlab v0.114.0
+	github.com/yusufpapurcu/wmi v1.2.4
 	go.etcd.io/etcd/api/v3 v3.5.17
 	go.etcd.io/etcd/client/v3 v3.5.17
 	go.mongodb.org/mongo-driver v1.14.0
@@ -521,7 +522,6 @@ require (
 	github.com/xlab/treeprint v1.2.0 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d // indirect
 	github.com/yuin/gopher-lua v1.1.1 // indirect
-	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	github.com/zeebo/errs v1.3.0 // indirect
 	github.com/zeebo/xxh3 v1.0.2 // indirect
 	github.com/zmap/zcrypto v0.0.0-20231219022726-a1f61fb1661c // indirect
diff --git a/lib/devicetrust/native/device_windows.go b/lib/devicetrust/native/device_windows.go
index 036f1e48e514d..b53f8627dc49e 100644
--- a/lib/devicetrust/native/device_windows.go
+++ b/lib/devicetrust/native/device_windows.go
@@ -19,17 +19,18 @@
 package native
 
 import (
-	"bytes"
 	"encoding/base64"
 	"errors"
+	"fmt"
 	"os"
-	"os/exec"
 	"os/user"
+	"strconv"
 	"time"
 
 	"github.com/google/go-attestation/attest"
 	"github.com/gravitational/trace"
 	log "github.com/sirupsen/logrus"
+	"github.com/yusufpapurcu/wmi"
 	"golang.org/x/sync/errgroup"
 	"golang.org/x/sys/windows"
 	"google.golang.org/protobuf/types/known/timestamppb"
@@ -78,106 +79,69 @@ func handleTPMActivateCredential(encryptedCredential, encryptedCredentialSecret
 	return windowsDevice.handleTPMActivateCredential(encryptedCredential, encryptedCredentialSecret)
 }
 
-// getDeviceSerial returns the serial number of the device using PowerShell to
-// grab the correct WMI objects. Getting it without calling into PS is possible,
-// but requires interfacing with the ancient Win32 COM APIs.
+// getDeviceSerial returns the serial number of the device.
 func getDeviceSerial() (string, error) {
-	cmd := exec.Command(
-		"powershell",
-		"-NoProfile",
-		"Get-WmiObject Win32_BIOS | Select -ExpandProperty SerialNumber",
-	)
-	// ThinkPad P P14s:
-	// PS > Get-WmiObject Win32_BIOS | Select -ExpandProperty SerialNumber
-	// PF47WND6
-	out, err := cmd.Output()
-	if err != nil {
+	type Win32_BIOS struct {
+		SerialNumber string
+	}
+
+	var bios Win32_BIOS
+	query := wmi.CreateQuery(&bios, "")
+	if err := wmi.Query(query, &bios); err != nil {
 		return "", trace.Wrap(err)
 	}
-	return string(bytes.TrimSpace(out)), nil
+
+	return bios.SerialNumber, nil
 }
 
 func getReportedAssetTag() (string, error) {
-	cmd := exec.Command(
-		"powershell",
-		"-NoProfile",
-		"Get-WmiObject Win32_SystemEnclosure | Select -ExpandProperty SMBIOSAssetTag",
-	)
-	// ThinkPad P P14s:
-	// PS > Get-WmiObject Win32_SystemEnclosure | Select -ExpandProperty SMBIOSAssetTag
-	// winaia_1337
-	out, err := cmd.Output()
-	if err != nil {
+	type Win32_SystemEnclosure struct {
+		SMBIOSAssetTag string
+	}
+
+	var system Win32_SystemEnclosure
+	query := wmi.CreateQuery(&system, "")
+	if err := wmi.Query(query, &system); err != nil {
 		return "", trace.Wrap(err)
 	}
-	return string(bytes.TrimSpace(out)), nil
+
+	return system.SMBIOSAssetTag, nil
 }
 
 func getDeviceModel() (string, error) {
-	cmd := exec.Command(
-		"powershell",
-		"-NoProfile",
-		"Get-WmiObject Win32_ComputerSystem | Select -ExpandProperty Model",
-	)
-	// ThinkPad P P14s:
-	// PS> Get-WmiObject Win32_ComputerSystem | Select -ExpandProperty Model
-	// 21J50013US
-	out, err := cmd.Output()
-	if err != nil {
+	type Win32_ComputerSystem struct {
+		Model string
+	}
+	var cs Win32_ComputerSystem
+	query := wmi.CreateQuery(&cs, "")
+	if err := wmi.Query(query, &cs); err != nil {
 		return "", trace.Wrap(err)
 	}
-	return string(bytes.TrimSpace(out)), nil
+
+	return cs.Model, nil
 }
 
 func getDeviceBaseBoardSerial() (string, error) {
-	cmd := exec.Command(
-		"powershell",
-		"-NoProfile",
-		"Get-WmiObject Win32_BaseBoard | Select -ExpandProperty SerialNumber",
-	)
-	// ThinkPad P P14s:
-	// PS> Get-WmiObject Win32_BaseBoard | Select -ExpandProperty SerialNumber
-	// L1HF2CM03ZT
-	out, err := cmd.Output()
-	if err != nil {
+	type Win32_BaseBoard struct {
+		SerialNumber string
+	}
+	var bb Win32_BaseBoard
+	query := wmi.CreateQuery(&bb, "")
+	if err := wmi.Query(query, &bb); err != nil {
 		return "", trace.Wrap(err)
 	}
 
-	return string(bytes.TrimSpace(out)), nil
+	return bb.SerialNumber, nil
 }
 
 func getOSVersion() (string, error) {
-	cmd := exec.Command(
-		"powershell",
-		"-NoProfile",
-		"Get-WmiObject Win32_OperatingSystem | Select -ExpandProperty Version",
-	)
-	// ThinkPad P P14s:
-	// PS>  Get-WmiObject Win32_OperatingSystem | Select -ExpandProperty Version
-	// 10.0.22621
-	out, err := cmd.Output()
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-
-	return string(bytes.TrimSpace(out)), nil
+	ver := windows.RtlGetVersion()
+	return fmt.Sprintf("%v.%v.%v", ver.MajorVersion, ver.MinorVersion, ver.BuildNumber), nil
 }
 
 func getOSBuildNumber() (string, error) {
-	cmd := exec.Command(
-		"powershell",
-		"-NoProfile",
-		"Get-WmiObject Win32_OperatingSystem | Select -ExpandProperty BuildNumber",
-	)
-	// ThinkPad P P14s:
-	// PS>  Get-WmiObject Win32_OperatingSystem | Select -ExpandProperty BuildNumber
-	// 22621
-	out, err := cmd.Output()
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-
-	return string(bytes.TrimSpace(out)), nil
+	ver := windows.RtlGetVersion()
+	return strconv.FormatInt(int64(ver.BuildNumber), 10), nil
 }
 
 func collectDeviceData(_ CollectDataMode) (*devicepb.DeviceCollectedData, error) {