How to Install Active Directory Users and Computers (ADUC) Snap-in on Windows

In this article, we’ll take a look at how to install the Active Directory Users and Computers snap-in on computers running Windows Server and desktop editions of Windows 11 and 10. Our guide covers RSAT installation on supported Windows 11 releases, including Windows 11 24H2 and 25H2. Windows 11 26H1 is a specialized release for select new hardware and is not a general feature update path for existing Windows 11 devices.

What Is Active Directory Users and Computers (ADUC)?

The Active Directory Users and Computers (ADUC) console is one of the main graphical tools for performing administrative tasks in an Active Directory domain. The ADUC is a Microsoft Management Console snap-in dsa.msc which is used to manage users, groups, computers, Organizational units, permissions, trust relationships and other objects in an on-premises AD domain. By default, the ADUC console is available on domain controllers, but it can also be installed on member Windows Server hosts and desktop workstations as part of RSAT (Remote Server Administration Tools).

Note. Microsoft also provides the Active Directory Administrative Center (ADAC), which complements ADUC with features such as Fine-Grained Password Policy management, Active Directory Recycle Bin management, and the PowerShell History Viewer. ADUC remains a supported MMC snap-in and is still widely used for traditional day-to-day AD administration. For automation and bulk operations, you should use PowerShell because it provides a more scalable approach.

Installing Active Directory Users and Computers Snap-in on Windows Server

By default, Active Directory domain controllers (DCs) have the Active Directory Users and Computers (ADUC) snap-in installed. It is installed on a Windows Server host when it’s promoted to the domain controller as part of the Active Directory Domain Services (AD DS) role deployment.

Note. ADUC is a GUI MMC snap-in and cannot be launched locally on Windows Server Core installations. You can manage AD remotely from another machine with RSAT installed.

Install ADUC snap-in via Server Manager

You can manually install the ADUC snap-in on any Windows Server 2025/2022/2019/2016 host using Server Manager (Add roles and features > Features > Remote Server Administration Tools > Role Administration Tools > AD DS and AD LDS Tools > AD DS Tools > AD DS Snaps-Ins and Command Line Tools).

Although Server Manager is still available, in modern enterprise environments it’s better to deploy RSAT features using PowerShell, config management tools, or automated provisioning solutions.

Install ADUC snap-in via PowerShell

You can also install Active Directory Users and Computers (ADUC) snap-in with the PowerShell command:

Install-WindowsFeature -Name RSAT-AD-Tools -IncludeAllSubFeature

Keep in mind that this cmdlet is only applicable to Windows Server. On client OS you should use Capabilities model.

In enterprise environments, you should prefer PowerShell-based installation because it can be automated, audited, and integrated into deployment pipelines (like Intune or SCCM task sequences).

Verify ADUC console Installation

Check that the ADUC console is installed on Windows Server:

Get-WindowsFeature -Name RSAT-AD-Tools

How to install ADUC on Windows 11 and 10

The Active Directory Users and Computers snap-in is part of the RSAT and can be installed on Windows 10 or 11 Pro and Enterprise editions (but not Home editions). RSAT contains various tools for remotely managing different Windows Server roles and features, including Active Directory.

Note. RSAT is not available on Windows 11/10 Home editions. In order to manage AD from a Home device, you need to use Remote Desktop to connect to a domain-joined machine with RSAT installed (or you can use web-based tools such as Windows Admin Center). In case you will attempt to install RSAT capabilities on Windows Home editions, you will fail because these Features on Demand are not supported on Home SKU.

In the current builds of Windows 11 and 10, RSAT components are available as Features on Demand (FoD). The concept of FoD is that some optional Windows system components are not installed by default, but can be added later when required. This reduces the size of the Windows image, but FoD requires an internet connection for installation because the binaries are downloaded from Microsoft Update servers.

RSAT features (including Active Directory management tools), can be installed on Windows 11 by using the Settings app or with PowerShell.

Enable Active Directory Users and Computers Console on Windows 10 and 11

Starting with Windows 10, version 1809, and later, the Active Directory Management RSAT tools can be installed as an optional FoD feature from the Settings app.

1. Press the Start menu > Settings > System;
2. Select Optional Features > Add an optional feature;
3. From the list of optional features, select RSAT: Active Directory Domain Services and Lightweight Directory Tools, and press Install.
   

   

4. Windows will download the ADUC RSAT binary files (a direct internet connection is required!) and install them on your computer.

Windows 10 version 1809 and later use RSAT as Features on Demand. Older Windows releases used a separate RSAT package and are outside the scope of this guide.

Install the ADUC Console on Windows 11 with PowerShell

The Active Directory console on Windows 11 can be installed using PowerShell. Open an elevated PowerShell prompt and check if the RSAT AD feature is installed:

Get-WindowsCapability -Name RSAT.Active* -Online

In this case, the RSAT: Active Directory Domain Services and Lightweight Directory Services Tools feature is not installed (State > NotPresent).

Run the following command to install it:

Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

Or use the DISM command to add the RSAT ADUC feature:

DISM /Online /Add-Capability /CapabilityName:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

Check the AD RSAT status with the command:

Get-WindowsCapability -Name Rsat.ActiveDirectory* -Online

The State should be changed to Installed.

Note. The PowerShell Active Directory module is also installed with the ADUC console. Keep in mind that the RSAT Active Directory feature installs both the ADUC MMC snap-in and the Active Directory PowerShell module as part of the same AD DS administration tools package.

Troubleshooting ADUC Installation Errors

Error 0x800f0954 and Offline RSAT Installation

Deploying RSAT ADUC with Microsoft Intune. In Microsoft Intune-managed environments, you can deploy RSAT as a Windows capability using an Intune PowerShell script. For example, our script below installs the Active Directory Domain Services and Lightweight Directory Services Tools capability, which includes the ADUC MMC snap-in:

$capability = Get-WindowsCapability -Online |
Where-Object Name -like 'Rsat.ActiveDirectory.DS-LDS.Tools*'

if ($capability.State -ne 'Installed') {
Add-WindowsCapability -Online -Name $capability.Name
}

Deploy the script from Intune admin center > Devices > Scripts and remediations and assign it to the required device group. Then run the script in the system context so that the capability can be installed without requiring the logged-on user to have admin rights.

For large enterprise deployments, you should use an appropriate device group and monitor deployment results rather than installing RSAT interactively on individual workstations.

For current deployment guidance, see Microsoft’s documentation on installing and managing RSAT as a Feature on Demand and deploying PowerShell scripts with Microsoft Intune.

Enterprise deployment note. In modern Microsoft 365 and Windows 11 enterprise environments, RSAT installation is often managed centrally using cloud-based deployment tools instead of manual/offline installation methods.

In an isolated environment, when Windows cannot connect directly to the Microsoft Update servers to download RSAT binaries, an error appears when trying to install the ADUC snap-in:

0x800f0954
No features to install

Note that in enterprise environments, RSAT (including ADUC) is typically deployed using:

• Microsoft Intune (Feature on Demand capability deployment)
• Windows Autopatch/Update rings
• Microsoft Endpoint Manager provisioning profiles

Intune allows you to deploy RSAT capabilities without relying on ISO media/WSUS configs. It significantly simplifies device provisioning in cloud-managed environments.

You can use the FoD ISO image to install the RSAT components on offline computers. FoD images are available for download from your Volume License Servicing Center (VLSC) or on my.visualstudio.com.

Download and mount the FoD ISO image to a virtual drive (for example, to drive F:). You can then install the ADUC feature from local (offline) media using the command:

Add-WindowsCapability -Online `
    -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0" `
    -Source "F:\" `
    -LimitAccess

Using Group Policy to Fix RSAT Installation

In managed enterprise environments, the source used to obtain Features on Demand (FoD) depends on the Windows servicing config. Devices managed through Windows Update/Windows Update for Business can normally obtain RSAT components from their configured update source. Environments that use WSUS, Configuration Manager, or other controlled update sources may require additional FoD source config.

For older Windows configs, to control where optional component content is obtained you should use the Group Policy setting Specify settings for optional component installation and component repair.

If you are using WSUS or SCCM to deploy Windows updates to client devices, you must enable the special GPO option to correctly install Features on Demand (including ADUC).

1. Open the local Group Policy Editor (gpedit.msc) and go to Computer Configuration > Administrative Templates > System;
2. Enable the GPO option Specify settings for optional component installation and component repair and check the Download repair content and optional features directly from Windows Update instead of Windows Server Update Services (WSUS). Do not enable this policy as a universal requirement. For Windows 11 24H2 and later, use the servicing and FoD guidance appropriate for the specific Windows release and your organization’s update-management architecture.

   

3. Update the Group Policy settings on the computer by using the command:
   gpupdate /force

Recommended approach selection

You need to choose the installation method based on your environment:

• Cloud-managed (Intune/Entra ID): You should use Feature on Demand via Intune
• Hybrid environment: You should use Add-WindowsCapability with Windows Update
• Isolated environment: You should use FoD ISO with -LimitAccess
• Legacy WSUS: you should use GPO policy adjustments

How to open ADUC Snap-in

To start the Active Directory snap-in on Windows 11, go to Start Menu > All Programs > Windows Tools. Find the Active Directory Users and Computers applet.

Note that in modern Windows 11 (23H2 and later), the classic Administrative Tools Control Panel view is deprecated. The same MMC snap-ins are now available via Windows Tools or by searching directly in the Start menu. You can quickly open the ADUC console by pressing Win+R, typing dsa.msc and clicking OK.

Managing Active Directory with the ADUC Snap-in

If your computer is joined to the Active Directory domain, the ADUC console will automatically connect to the nearest DC in your Active Directory site.

If the console can’t find the domain controller, you can use the PowerShell command to get the name of your LogonServer:

$env:LOGONSERVER

You can also use the following PowerShell command. It uses the DC Locator process and returns the DC selected for the current client:

Get-ADDomainController -Discover

The command above requires the Active Directory PowerShell module, which is installed together with the RSAT AD DS Tools package.

Right-click on the root in the ADUC console and select Change Domain Controller. Select the name of your logon DC from the list.

For routine administration, we recommend using a DC in the local AD site. However, troubleshooting replication issues/validating changes may require connecting to a specific DC. The RSAT console may become slow when working with a DC at a remote site.

To find the closest DC, run the following commands:

nltest /dsgetdc:domain.com

You should review the returned DC Name, Site Name, and Flags fields to check which DC and AD site were selected by the locator service.

Or use the following command:

$env:LOGONSERVER

Using ADUC on Non-Domain Computers

If you want to connect to AD using the dsa.msc snap-in from a non-domain (workgroup) computer:

1. Run the command (a blank MMC console will open):
   

   runas /netonly /user:Domain_Name\Domain_USER mmc

   
   Note. The /netonly option does not validate credentials when the MMC starts. Authentication occurs only when the console contacts a DC. In case the username/password is incorrect, you may face connection errors later when browsing AD.
2. Select File > Add/Remove Snap-In;
3. Add Active Directory Users and Computers snap-in to the right pane and press OK;
   

   

4. Connect to the domain with right-click on ADUC > Connect to the domain and enter the domain name.
   

   

Alternatively, you can use Run as different user to start ADUC under a dedicated admin account instead of using their daily user account.

Note. When running ADUC from a workgroup machine, authentication may fall back to NTLM. Keep in mind that Kerberos authentication requires proper DNS resolution and connectivity to DCs.

You can also create a desktop shortcut that contains the username and the target Active Directory domain to which to connect:

runas /user:theitbros\admin1 "c:\windows\system32\mmc.exe %SystemRoot%\system32\dsa.msc /domain:theitbros.com"

The ADUC snap-in will display your Active Directory domain structure in a tree view.

You will see a standard set of Active Directory OUs and containers:

• Saved Queries — saved search criteria for quick searches against Active Directory (LDAP query supported);
• Builtin — built-in user accounts;
• Computers — default container for computer accounts;
• Domain Controllers — default container for domain controllers;
• ForeignSecurityPrincipals — contains information about objects from trusted external domains;
• Users — default container for user accounts.

Depending on the domain structure, the ADUC console may contain other containers. Some AD containers are not displayed by default. To display them, select View > Advanced Features in the top menu.

Note that when Advanced Features is enabled, an additional Attribute Editor tab becomes available for many AD objects. This allows you to view and modify a large number of LDAP attributes directly from ADUC without opening ADSI Edit.

Perform the following actions in the ADUC console

• Create and manage user accounts, computers, and Active Directory groups;
• View advanced LDAP attributes (via Attribute Editor/ADSI Edit);
• Search for AD objects;
• Change user password in Active Directory or reset it;
• Create Organizational Units and build hierarchical structures for AD objects. Enable or disable OU accidental deletion protection;
• Delegate administrative permission to OUs to non-admin domain users;
• Raise domain functional level, and move FSMO roles to another DC;
• View deleted-object related containers (with Advanced Features enabled) and perform recovery operations through ADAC/PowerShell when AD Recycle Bin is enabled.

Get-WindowsFeature -Name RSAT-ADDS-Tools