How to Install and Import PowerShell Active Directory Module?

A common misconception, especially with new Windows system administrators, is they should log in to the domain controller server to manage the Active Directory. I’ve seen organizations where even the frontline service desk is allowed to log in to the domain controller servers just to provision new user accounts or create groups.

Microsoft provides Remote Server Administration Tools (RSAT), which allow you to remotely manage AD and other Windows Server roles and features from supported Windows client/server computers. RSAT includes the Active Directory PowerShell module, which provides PowerShell cmdlets for managing AD.

In this tutorial, we’ll show different ways to have the Active Directory module on Windows Server and client computers.

Note. Any installation method using DISM or Add-WindowsCapability installs only the specific RSAT capability you specify (for example, Active Directory tools), not all RSAT components. On Windows 10/11, RSAT is delivered as Feature on Demand and is not a single package. It’s a collection of independent Features on Demand, and you need to install each tool independently.

Secure Active Directory administration in enterprise environments

Note that you should avoid using DCs as general-purpose administration workstations. Admin access should follow a least-privilege model and separate admin identities and workstations according to the level of access they provide.

Microsoft’s AD DS tier model separates admin resources into Tier 0, Tier 1, and Tier 2. DCs and identities that can control AD belong to Tier 0. Privileged Access Workstations (PAWs) should match the tier of the resources being administered. A workstation/jump host used to access Tier 0 resources should therefore be treated as a Tier 0 asset and protected accordingly.

For example, routine AD administration should be performed from a dedicated admin workstation or an appropriately secured management/jump host rather than from a user’s everyday workstation or by signing in interactively to a DC. You should use separate privileged accounts where required, grant admins only the permissions needed for their role, and avoid using highly privileged accounts for routine tasks.

For delegated admin tasks, you should consider Just Enough Administration (JEA) to expose only the commands and parameters required for a specific operational role instead of granting broad admin rights. JEA is particularly useful for controlled service-desk/delegated admin cases.

Install PowerShell Active Directory Module on Windows Server

On Windows Server 2022 and Windows Server 2025, the Active Directory PowerShell module is available as part of the Remote Server Administration Tools (RSAT). In case you install the AD DS role together with its management tools, the Active Directory module is typically installed as well. However, you can install the RSAT-AD-PowerShell feature separately on a member server/administrative server without installing the AD DS role. The procedures below apply to both Windows Server 2022 and Windows Server 2025.

There are a few ways to install the Active Directory Module on Windows Servers, and we’ll tackle them next.

Windows Server 2022 and Windows Server 2025

Note that you can install The Active Directory PowerShell module on supported Windows Server 2022 and Windows Server 2025 systems independently of the AD DS server role. On Windows Server, the corresponding RSAT feature is RSAT-AD-PowerShell.

You can use PowerShell to check whether the feature is available:

Get-WindowsFeature -Name RSAT-AD-PowerShell

Using the Add Roles and Features Wizard (Server Manager Console)

The Server Manager console is a graphical user interface to manage the local and remote servers. It also allows administrators to install roles and features, including the Active Directory Module.

On your server, open the Server Manager.

On the Dashboard, click Add roles and features.

When the Add Roles and Features Wizard window shows up, click Next until you reach the Features page.

Expand Remote Server Administration Tools → Role Administration Tools → AD DS and AD LDS Tools, and select Active Directory module for Windows PowerShell. Then click Next.

On the Confirmation page, review the selection and click Install.

Wait for the installation to finish and click Close.

Using Install-WindowsFeature Cmdlet (ServerManager Module)

Installing features in the Server Manager console has a cmdlet counterpart in PowerShell called Install-WindowsFeature. This cmdlet also has an alias called Add-WindowsFeature. These cmdlets are part of the ServerManager module that’s built-in to Windows servers.

But first, let’s find out the Active Directory Module for Windows PowerShell feature status. Open Windows PowerShell as admin and run this command.

Get-WindowsFeature -Name RSAT*

As you can see below, the RSAT-AD-PowerShell feature install state is available. This status means we can install it.

Run this command to install the RSAT-AD-PowerShell feature.

Install-WindowsFeature -Name RSAT-AD-PowerShell

The screenshot below shows the result of a successful installation.

Install PowerShell Active Directory Module on Windows 11

Notes.

On supported Windows 11 releases, RSAT is delivered as Features on Demand (FoD). The Active Directory PowerShell module is included in the RSAT: Active Directory Domain Services and Lightweight Directory Services Tools capability.

This procedure applies to Windows 11 24H2 and 25H2. Windows 11 25H2 is the current mainstream release, while Windows 11 24H2 remains supported for applicable Enterprise and Education editions.

Note that RSAT is not available on Windows 11 Home. The RSAT tools described below require a supported Windows 11 edition (such as Pro, Enterprise, or Education).

ARM64 note. On Windows 11 25H2 ARM64 devices, RSAT Features on Demand are not supported. Microsoft provides the supported RSAT tools through Control Panel → Programs → Programs and Features → Turn Windows features on or off instead.

Using the Optional Features in Windows Settings

On your Windows computer, press WIN+R and run this command to open the Optional Features settings.

ms-settings:optionalfeatures

Click the “View features” button.

In the Add an optional feature window, search RSAT, check the RSAT: Active Directory Domain Services and Lightweight Directory Services Tools box, and click Next.

Click Install on the next page.

Wait for the feature to finish installing.

Using the Add-WindowsCapability Cmdlet (DISM Module)

Another method to install RSAT via Feature on Demand is the Add-WindowsCapability cmdlet. This cmdlet is part of the DISM module in Windows PowerShell.

Open Windows PowerShell as admin and run this command to find the RSAT feature to install.

Get-WindowsCapability -Online -Name RSAT* | Format-Table

As you can see, multiple features match. But in this instance, what we want is the Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0. Notice that the State is NotPresent, which means it is not yet installed.

To install, run this command:

Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

Wait for the installation to finish.

Using DISM.exe

You can also install RSAT using the DISM.exe tool. To do so, open an elevated CMD or PowerShell and run this command.

DISM.exe /Online /Add-Capability /CapabilityName:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

Note that Add-WindowsCapability and DISM.exe perform the same underlying servicing operation (but Add-WindowsCapability provides a PowerShell-native interface with structured output).

Import PowerShell Active Directory Module after Installing

Now that you’ve installed the PowerShell Active Directory Module, you can import it into Windows PowerShell using this command.

Import-Module ActiveDirectory

Active Directory Web Services and Firewall Requirements

The Active Directory PowerShell module communicates with DCs through Active Directory Web Services (ADWS). ADWS listens on TCP port 9389. The AD cmdlets connect to ADWS, and ADWS communicates with the local Active Directory service on the DC.

In case the Active Directory module is installed correctly but commands such as Get-ADDomain or Get-ADUser cannot connect to Active Directory, you need to check network connectivity between the admin computer and the DC.

The Windows Firewall rule Active Directory Web Services (TCP-in) is enabled by default on DCs. However, a firewall between the admin’s workstation and the DC, a network ACL, or endpoint security software can still block TCP 9389. We recommend specifically checking this port when troubleshooting ADWS connectivity.

You can test TCP 9389 from the computer where you are running the AD module:

Test-NetConnection -ComputerName dc01.contoso.com -Port 9389

A successful test should show:

TcpTestSucceeded : True

In case the test fails, you need to check that the Active Directory Web Services service is running on the DC and that firewalls between the client and DC allow inbound TCP 9389. Do not open the port broadly; restrict access to the admin networks/hosts that actually require AD management.

Using the Active Directory Module with PowerShell 7

The Active Directory PowerShell module can be used natively with PowerShell 7 on supported Windows versions. You do not need -UseWindowsPowerShell to load the current Active Directory module.

After installing RSAT, import the module normally with the command below:

Import-Module ActiveDirectory

Now check if PowerShell can find the module:

Get-Module ActiveDirectory -ListAvailable

You can also verify that the Active Directory cmdlets are available:

Get-Command -Module ActiveDirectory

Keep in mind that you should generally prefer PowerShell 7 for new admin scripts and automation. Windows PowerShell 5.1 remains available for older scripts and modules that have not been migrated to PowerShell 7.

Compatibility note

-UseWindowsPowerShell is still useful for older Windows PowerShell-only modules that do not support PowerShell 7 natively. In case existing automation depends on such modules, you should test those scripts before migrating them to PowerShell 7.

Performance note

Keep in mind that PowerShell 7 does not automatically make AD queries faster. AD cmdlets still communicate with DCs through the underlying Active Directory interfaces and are primarily affected by the LDAP query, network latency, domain controller response time, and the amount of data returned.

In case you are working with large enterprise directories, you should avoid unnecessarily broad queries such as:

Get-ADUser -Filter *

You should prefer targeted filters, -SearchBase, -Properties only when required, and result limits where appropriate.

Use the Active Directory Module Remotely Without Installing RSAT

In case the AD module is not installed on your local machine, you can still use it remotely from a computer where RSAT is installed. PowerShell provides you with two methods: import the module directly into a remote session with Import-Module -PSSession, or create a reusable proxy module with Export-PSSession.

In such scenario, the commands are executed on the remote system rather than imported locally. This allows you to use the module functionality without installing it on your local machine.

First, create a PowerShell remoting session to a dedicated management/jump host where the ActiveDirectory module is installed (this host should be appropriately secured for the administrative tier being managed):

$session = New-PSSession -ComputerName MGMT01

Keep in mind that the remote host does not need to be a DC. You should use a dedicated management server/appropriately secured jump host instead of treating a DC as a general-purpose PowerShell endpoint.

Now Import the ActiveDirectory module from the remote machine into the current PowerShell session:

Import-Module ActiveDirectory -PSSession $session

You can now use the AD cmdlets through the remote session. For example:

Get-ADUser -Identity administrator

The ActiveDirectory module remains installed on the remote machine. The local session uses proxy commands to execute the AD cmdlets remotely. No exported module is saved to disk.

Create a Persistent Proxy Module with Export-PSSession

If you want to save the remote module as a proxy module on the local computer, use Export-PSSession. First, you need to ensure that the ActiveDirectory module is loaded in the remote session. Use the command below:

Invoke-Command -Session $session -ScriptBlock {
Import-Module ActiveDirectory
}

Next, export the ActiveDirectory module from the remote computer to the local machine:

Export-PSSession -Session $session -Module ActiveDirectory -OutputModule RemoteADModule

Export-PSSession creates a proxy module that contains local proxy commands for the commands exported from the remote session. The proxy module is saved to disk and you can import it later in PowerShell session. When the proxy module is used, PowerShell establishes a remote connection to the machine from which the commands were exported.

Note that the exported module does not contain the Active Directory module binaries. Instead, it contains proxy commands that forward requests to the remote session. The proxy module therefore depends on the remote session and will stop working if the session is closed/becomes unavailable.

The remote ActiveDirectory module is now exported as the RemoteADModule proxy module. Import the proxy module with the command:

Import-Module RemoteADModule

Note. This method requires PowerShell remoting to be available on the remote machine. Commands are executed remotely, so performance and availability depend on the network connection and the remote PowerShell session.

Wrapping up

Here is a quick summary of all installation methods:

For most environments:

• Windows 11 24H2/25H2: install the required RSAT capability with Add-WindowsCapability.
• Windows Server 2022/2025: install the RSAT-AD-PowerShell feature with Install-WindowsFeature.
• Administrative workstations: install RSAT on the administrator’s workstation/dedicated management host instead of routinely logging on to DCs.
• Windows 10: do not use it as the target platform for new deployments because Windows 10 22H2 reached end of support on October 14, 2025.

Import-Module ActiveDirectory