Windows 10 & 11: Install Active Directory Users and Computers

Install Active Directory Users and Computers (ADUC) on Windows 10 or Windows 11 by adding the optional feature RSAT: Active Directory Domain Services and Lightweight Directory Services Tools, then run dsa.msc to open it.

This guide covers the Settings route, the PowerShell command, the Arm64 exception, how to open and connect the console, and fixes for a missing feature or a blocked install.

The fastest way to install ADUC

One command installs ADUC on Windows 10 (version 1809 or later) and Windows 11, Pro or Enterprise. The PC needs internet access to Windows Update.

1. Select Start, type *PowerShell*, and select Run as administrator.
2. Run Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 and wait for the prompt to return.
3. Check that the output shows Online : True.
4. Press Win + R, type dsa.msc and press Enter to open Active Directory Users and Computers.

The Optional features route below installs the same package if you prefer menus to a command.

What Active Directory Users and Computers Is Used For

ADUC is the console for creating, deleting and managing user, group and computer accounts in an Active Directory domain. It runs on your workstation and talks to a domain controller over the network, so nothing is installed on the server.

It ships inside the AD DS and AD LDS tools package, which also brings several related consoles and command-line tools.

Common ADUC management task	Where you do it in the console
Create a user account	Select the OU or container, then Action > New > User
Reset a password and unlock a locked account	Select the user, then Action > Reset Password; tick Unlock the user account if needed
Add or remove group memberships	Open the user's Properties and use the Member Of tab
Disable, enable or delete an account	Select the user, then Action > Disable Account, Enable Account or Delete
See hidden tabs such as Attribute Editor	Turn on View > Advanced Features
Delegate permissions on an OU or container	Right-click it and select Delegate Control

The same package also installs Active Directory Administrative Center, Active Directory Domains and Trusts, Active Directory Sites and Services, ADSI Edit, the Active Directory module for Windows PowerShell, and tools such as DCDiag, RepAdmin and DSQuery.

Prerequisites for Installing ADUC on Windows 10 and Windows 11

Check the edition first, because it decides whether the feature appears at all.

Requirement	What Microsoft states	How to check
Windows edition	Pro or Enterprise only. RSAT cannot be installed on Home.	Settings > System > About, then read Edition
Windows 10 version	Version 1809 (October 2018 update) or later for the Features on Demand install	Press Win + R, type winver and press Enter
Windows 11 version	Any supported release on x64. Arm64 devices on version 25H2 use a different route (see below)	Run winver and read the version line
Local rights	An administrator account on the PC where ADUC is installed	Accept the UAC prompt when PowerShell or Settings asks
Network source	Windows Update, or a WSUS or Configuration Manager setup that allows Features on Demand	See the WSUS fix in the troubleshooting section
Domain access	Network connectivity to a domain controller and an account with rights in Active Directory	Sign in with a domain account, or use runas /netonly from a non-joined PC

Windows 10 builds older than 1809 used a separate RSAT download package. On 1809 and later, RSAT is part of Windows and installs as Features on Demand.

Which install method should you use?

Your situation	Use this	Why
One PC, you prefer the GUI	Optional features in Settings	Search, tick, install; no command to type
One PC, you are comfortable with a shell	Add-WindowsCapability in PowerShell	One line, and the output proves success
Several PCs or a build script	PowerShell or DISM /Online /Add-Capability	Scriptable and repeatable across machines
Windows 11 version 25H2 on an Arm64 device	Turn Windows features on or off	RSAT Features on Demand are not supported on Arm64
Windows 10 or 11 Home	Upgrade to Pro first	RSAT is blocked on Home editions

Install ADUC from Windows Optional Features

The package is listed as RSAT: Active Directory Domain Services and Lightweight Directory Services Tools. Searching the list for *Active Directory* finds it faster than scrolling.

1. Select Start, type *Optional features* and open the matching Settings result.
2. On Windows 11, select View features next to Add an optional feature. On Windows 10, select Add a feature.
3. Type *Active Directory* in the search box.
4. Tick RSAT: Active Directory Domain Services and Lightweight Directory Services Tools.
5. On Windows 11, select Next, then Install. On Windows 10, select Install.
6. Wait for the install to finish; the feature then appears in the installed features list.

The Settings path depends on the build: Windows 11 and newer Windows 10 releases place Optional features under System, while older builds place it under Apps. Searching from Start avoids that difference.

The AD DS tools depend on RSAT: Server Manager, so Windows adds Server Manager automatically if it is missing.

Install ADUC on Windows 11 on Arm (version 25H2)

Microsoft states that RSAT Features on Demand are not supported on Arm64 devices running Windows 11 version 25H2. A subset of the tools, including the AD DS and AD LDS tools, sits in the classic Windows Features dialog instead.

1. Open Control Panel and select Programs.
2. Under Programs and Features, select Turn Windows features on or off.
3. Tick RSAT: Active Directory Domain Services and Lightweight Directory Services Tools.
4. Select OK and wait for Windows to apply the change.

The other RSAT tools available this way on Arm64 are the AD Certificate Services, Server Manager, Group Policy Management, DNS Server and DHCP Server tools.

Install ADUC Using PowerShell

Open PowerShell as administrator. First confirm the capability name and state, then install it.

To check whether the ADUC RSAT feature is available, run Get-WindowsCapability -Online | Where-Object Name -like 'Rsat.ActiveDirectory*'. A result of State : NotPresent means it can be installed; Installed means it already is.

Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

-Online targets the running copy of Windows, and -Name is the exact Features on Demand capability for the AD DS and AD LDS tools. Windows downloads the package from Windows Update and pulls in the Server Manager dependency.

You should see: The command returns Online : True. RestartNeeded normally reads False, so ADUC is usable straight away.

The DISM equivalent is DISM /Online /Add-Capability /CapabilityName:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0. It uses the same source order: a group policy location first, then Windows Update.

To install ADUC on multiple computers, run either command through your deployment tool, a startup script, or Invoke-Command against a list of machines. Each target still needs access to Windows Update or an allowed repair source.

How to Open Active Directory Users and Computers

Opening the console is also the proof that the install worked. If the domain tree loads, ADUC is installed and can reach a domain controller.

1. Press Win + R, type dsa.msc and press Enter.
2. Or select Start, type *Active Directory Users and Computers* and open the result.
3. On Windows 11, you can also open Windows Tools from the Start menu and double-click Active Directory Users and Computers.
4. Expand your domain in the left pane and confirm containers such as Users and Computers are listed.
5. To confirm from PowerShell, run Get-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 and check for State : Installed.

By default, members of Domain Admins and Enterprise Admins can manage users, groups and computers. Account Operators can manage user accounts but not groups or permissions.

Use ADUC from a PC that is not joined to the domain

Microsoft's ADUC documentation assumes a domain-joined PC. From a workgroup PC or personal laptop, the built-in runas command with /netonly passes domain credentials for network access only, which Microsoft documents for administering a server in another domain.

1. Make sure the PC can resolve the domain name, which usually means using the domain's DNS servers.
2. Open Command Prompt.
3. Run runas /netonly /user:CONTOSOdminname "mmc dsa.msc", replacing CONTOSO and adminname with your domain and account.
4. Enter the domain password when prompted.
5. Expand the domain in the console once it loads. If runas fails, check that the Secondary Logon service is running.

How to remove ADUC

You can also remove the package from the installed list in Optional features. The command below does the same job and works in scripts.

DISM /Online /Remove-Capability /CapabilityName:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

Run it in an elevated Command Prompt or PowerShell window. /Online targets the running Windows installation, and /Remove-Capability uninstalls the AD DS and AD LDS tools package, including ADUC.

You should see: DISM reports that the operation completed successfully, and dsa.msc no longer opens.

Windows refuses to remove a capability that another installed tool depends on. The BitLocker recovery tools depend on the AD DS tools, so remove those first.

Troubleshooting Missing ADUC or RSAT Installation Issues

The RSAT features do not appear in Optional features

The PC runs a Home edition, a Windows 10 build older than 1809, or Windows 11 on Arm64.

1. Check the edition under Settings > System > About. Home needs an upgrade to Pro before RSAT can install.
2. Run winver and update Windows 10 to a supported release if it is older than 1809.
3. On an Arm64 device with Windows 11 version 25H2, use Turn Windows features on or off instead.

The PowerShell installation fails or Optional features stalls on a work PC

The PC gets updates from WSUS or Configuration Manager, which on Windows 10 version 1709 through Windows 11 version 21H2 cannot host Features on Demand.

1. Ask your administrator whether the Specify settings for optional component installation and component repair policy is configured. It sits under Computer Configuration > Administrative Templates > System.
2. On Windows 10 version 2004 through Windows 11 version 21H2, that policy must point to Windows Update, and the update source policies must not force feature or quality updates to WSUS.
3. On Windows 11 version 22H2 and later, Features on Demand come through WSUS again, so ask the WSUS admin to sync that content.
4. Rerun the Add-WindowsCapability command once the policy change has applied.

Installed, but ADUC is missing from Start

Search indexing has not caught up, or a different RSAT tool was installed instead.

1. Press Win + R, type dsa.msc and press Enter. This opens the snap-in regardless of Start menu state.
2. Run Get-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 and confirm State : Installed.
3. If the state is NotPresent, install it again; Group Policy Management or DNS tools do not include ADUC.

ADUC opens but cannot manage users or reports that the domain cannot be contacted

The PC cannot reach a domain controller, or the account lacks permissions in Active Directory.

1. Confirm the PC uses the domain's DNS servers and can reach the network, including over VPN.
2. On a non-joined PC, start ADUC with runas /netonly and a domain account.
3. If objects load but changes fail with access denied, ask a domain administrator for delegated rights on the relevant OU.

Frequently Asked Questions

Do I need Windows Pro or Enterprise to install Active Directory Users and Computers?

Yes. Microsoft supports RSAT, which includes ADUC, only on Pro and Enterprise editions of Windows 10 and Windows 11. On Home, the RSAT features are unavailable, so upgrade the edition to Pro before installing the Active Directory tools.

What is the PowerShell command to install ADUC on Windows 10 or Windows 11?

Run Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 in an elevated PowerShell window. It downloads the AD DS and AD LDS tools from Windows Update and installs ADUC along with the Server Manager dependency.

Where do I open Active Directory Users and Computers after installing RSAT?

Press Win + R, type dsa.msc and press Enter. You can also search Start for Active Directory Users and Computers, or open Windows Tools on Windows 11, where the console appears with the other administrative tools.

Why can I install ADUC but still cannot manage users or computers?

ADUC only provides the console. Your account needs permissions in Active Directory, and the PC must reach a domain controller through DNS. On a PC outside the domain, start ADUC with runas /netonly and a domain account.

What should I do if ADUC is missing after installing RSAT?

Check that the specific AD DS and AD LDS tools package is installed, because other RSAT tools do not include ADUC. Run Get-WindowsCapability for the capability name, confirm the state reads Installed, then launch dsa.msc directly.

Do I need to download RSAT separately for Windows 10 or 11?

No. Since Windows 10 version 1809, RSAT ships as Features on Demand inside Windows. You add it from Optional features or with PowerShell, and Windows fetches the package from Windows Update. The old standalone download applied only to earlier builds.

Does installing ADUC require a restart?

Usually not. Microsoft's documented output for the install command shows RestartNeeded as False, so the console opens immediately. If the command output shows True, restart before opening ADUC.

Can I install ADUC on Windows 11 on an Arm device?

Yes, on Windows 11 version 25H2. RSAT Features on Demand are not supported on Arm64, but the AD DS and AD LDS tools are available through Control Panel under Turn Windows features on or off.

Bottom Line

On a Pro or Enterprise PC, run the single Add-WindowsCapability command, then open dsa.msc to confirm the domain tree loads. It installs the exact AD DS tools package, proves success in its output, and scales to more machines unchanged. The Settings route suits one-off installs, and managed PCs that fail usually need the repair-source policy fixed rather than a different installer.