Enabling ADUC and Other Admin Tools

Administrators often use tools such as Active Directory Users and Computers (ADUC), and other MMC snap-ins, collectively named Remote Server Admin Tools (RSAT). For Windows 10 build 1809 and newer, RSAT is not a typical install file like it was in previous builds. Instead, it’s a capability or feature that you enable if you need it. The steps below are demonstrated using PowerShell. Each of these steps could alternatively be accomplished using Graphical User Interface (GUI) methods. However, I chose to show PowerShell because when the GUI changes, the PowerShell will likely remain unchanged. The graphical tool to add capabilities is called “Optional features” within the Windows “Settings” app.

Note: Enabling RSAT relies on source files. Usually, these are obtained seamlessly in the background from Windows Update. If the ‘Add-WindowsCapability’ commands are not working, and you’ve already checked the UseWUServer registry key, you can use the following workaround: Obtain the Features on Demand (FOD) files, and place them in a directory. For example: ‘c:\path\2\FOD\’. Next, run the command, but tell it where the FOD files are. The syntax is shown below with the two required parameters appearing first:

Add-WindowsCapability -LimitAccess -Source 'c:\path\2\FOD' -Online -Name 'Rsat.Dns.Tools~~~~0.0.1.0'

1. Open an elevated PowerShell window (It must say ‘Administrator:’ at the top or it’s not elevated)

2. Temporarily modify the following registry value if needed. If your system has ‘UseWUServer’ set to ‘1’, you must temporarily change it to ‘0’. This tells Windows to not use a WSUS server. The registry entry is shown below followed by PowerShell commands to check the value and if needed, make the change.

   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\UseWUServer

   # Get/show current value, then if needed, temporarily set value
   Get-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\ |
       Select UseWUServer
   Set-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\ -Name UseWUServer -Value 0

3. For that change to take effect, restart the Windows Update service:

   # PassThru (optional) allows you to see the final service status
   Restart-Service wuauserv -PassThru

4. To see all RSAT capabilities, use the below PowerShell:

   $Capabilities = Get-WindowsCapability -Online
   $Capabilities | Where-Object { $_.Name -match 'rsat' } |
       Sort-Object State |
       Format-Table -GroupBy State 

5. A list of all RSAT capabilities is shown below. You can enable or disable these capabilities as needed.

   Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0
   Rsat.AzureStack.HCI.Management.Tools~~~~0.0.1.0
   Rsat.BitLocker.Recovery.Tools~~~~0.0.1.0
   Rsat.CertificateServices.Tools~~~~0.0.1.0
   Rsat.DHCP.Tools~~~~0.0.1.0
   Rsat.Dns.Tools~~~~0.0.1.0
   Rsat.FailoverCluster.Management.Tools~~~~0.0.1.0
   Rsat.FileServices.Tools~~~~0.0.1.0
   Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0
   Rsat.IPAM.Client.Tools~~~~0.0.1.0
   Rsat.LLDP.Tools~~~~0.0.1.0
   Rsat.NetworkController.Tools~~~~0.0.1.0
   Rsat.NetworkLoadBalancing.Tools~~~~0.0.1.0
   Rsat.RemoteAccess.Management.Tools~~~~0.0.1.0
   Rsat.RemoteDesktop.Services.Tools~~~~0.0.1.0
   Rsat.ServerManager.Tools~~~~0.0.1.0
   Rsat.Shielded.VM.Tools~~~~0.0.1.0
   Rsat.StorageMigrationService.Management.Tools~~~~0.0.1.0
   Rsat.StorageReplica.Tools~~~~0.0.1.0
   Rsat.SystemInsights.Management.Tools~~~~0.0.1.0
   Rsat.VolumeActivation.Tools~~~~0.0.1.0
   Rsat.WSUS.Tools~~~~0.0.1.0

6. Use the ‘Add-WindowsCapability’ cmdlet to add a capability you want. Unfortunately, it only allows a single name, so you can either add one capability at a time or use a loop to specify multiple. The following PowerShell snippet shows an example of doing it both ways.

   # Add a single capability
   Add-WindowsCapability -Online -Name 'Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0'
   
   # Add multiple capabilities using a loop
   $ToolArray = @('Rsat.BitLocker.Recovery.Tools~~~~0.0.1.0',
                  'Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0',
                  'Rsat.DHCP.Tools~~~~0.0.1.0')
   foreach ($Tool in $ToolArray) { Add-WindowsCapability -Online -Name $Tool }
   

7. Once you’re finished enabling RSAT capabilities, if you changed 'UseWUServer' (in step 2), change it back. This would happen automatically anyway, but the Windows Update service ‘wuauserv’ does not get auto restarted after the change, so it's best to manually do this step and the next one. It’s done with PowerShell like this:

   # Set the value, then show the value
   Set-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\ -Name UseWUServer -Value 1
   Get-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\ |
       Select UseWUServer

8. Now restart the Windows Update service.

   Restart-Service wuauserv -PassThru

9. When any of the added tools are no longer needed, you can remove them with a very similar command. Instead of using the ‘Add-WindowsCapability’ cmdlet, you use ‘Remove-WindowsCapability’. Here is an example:

Remove-WindowsCapability -Online -Name 'Rsat.FailoverCluster.Management.Tools~~~~0.0.1.0'

This final section is included purely for educational purposes.

The cmdlets with the noun ‘WindowsCapability’ are a PowerShell front-end to ‘Dism.exe’ commands. Those commands have been around longer, and can be ran using PowerShell or CMD. Example commands are shown below.

# Install AD Tools
Dism.exe /Online /Add-Capability /CapabilityName:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0
# Show capabilities
Dism.exe /Online /Get-Capabilities
# Remove AD Tools
Dism.exe /Online /Remove-Capability /CapabilityName:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0