How to Easy Install RSAT on Windows 11

Why we need Install RSAT ? Windows 11 doesn’t ship with Active Directory Users and Computers, DNS Manager, or Group Policy Management. If you manage a domain from your workstation instead of RDPing into a server for every small change, you have to add Remote Server Administration Tools (RSAT) yourself. The good part: on Windows 11, RSAT isn’t a separate download that goes stale after the next feature update. It ships as a set of Features on Demand baked into the OS image, and you enable only what you actually need.

That’s a real improvement over the old RSAT-for-Windows-10 era, when you downloaded a standalone MSU that had to match your exact build and reinstalled it after every feature update or watched it silently break. On Windows 10 version 1809 and later, and on every release of Windows 11, RSAT installs and updates alongside Windows itself — no separate package to track.

How do you install RSAT on Windows 11?

Open Settings, go to Optional Features, select View features, search for RSAT, pick the tools you need, and install. On Windows 11 24H2 and later, Optional Features sits under System; on earlier builds it’s under Apps. From an elevated PowerShell session, Get-WindowsCapability -Name RSAT* -Online lists what’s available and installed, and Add-WindowsCapability -Online -Name <capability name> installs a specific tool. RSAT requires Windows 11 Pro or Enterprise — Home doesn’t have the option at all.

Before you start

RSAT on Windows 11 needs Pro or Enterprise. Home doesn’t expose the optional feature in Settings, and the underlying capability isn’t available to install on it through PowerShell either — this isn’t a hidden unlock, it’s an edition restriction. You’ll also need local admin rights on the machine, plus actual network reachability to whatever server role you’re planning to manage. Installing the AD DS tools doesn’t do anything useful without line of sight to a domain controller.

Before assuming something’s broken, check which servicing branch you’re on. Nothing about RSAT itself changed recently, but Microsoft moved the Optional Features page inside Settings more than once, and that alone explains a chunk of “I can’t find RSAT anywhere” reports.

Installing RSAT from Settings

Where you find it depends on your build:

• Windows 11 24H2 and newer: Settings > System > Optional features
• Windows 11 23H2 and earlier: Settings > Apps > Optional features

Rather than track which applies to your build, just search for it. Press Start, type Optional features, and open it directly — that sidesteps the Apps-vs-System question entirely. Win+R, then ms-settings:optionalfeatures, does the same thing if you’re documenting steps for someone else.

From there:

1. Select View features next to Add an optional feature.
2. Type RSAT in the search box. Everything installable shows up as individual entries — RSAT: Active Directory Domain Services and Lightweight Directory Services Tools, RSAT: DNS Server Tools, RSAT: Group Policy Management Tools, and so on.
3. Check the boxes for what you need, select Next, review the list, then Install.
4. Wait for each item to report Installed rather than judging by the progress indicator — it isn’t always obvious when the install has actually finished versus just accepted the request.

Once installed, the consoles live under Windows Tools, not Administrative Tools. Microsoft renamed that Start menu folder starting with a late Windows 10 Insider build, and Windows 11 kept the new name. Searching “Administrative Tools” from Start still finds it by association, but “Windows Tools” is the current name.

Installing RSAT from PowerShell

For more than one machine, PowerShell is faster and scriptable. Open an elevated session and check what’s already there:

Get-WindowsCapability -Name RSAT* -Online | Select-Object -Property Name, DisplayName, StateCode language: JavaScript (javascript)

State reads Installed, NotPresent, or occasionally Staged. The Name column is what you pass to Add-WindowsCapability — DisplayName is just for a human to read. To add the AD DS and LDS tools specifically:

Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0"Code language: CSS (css)

Swap the name for whichever capability you actually need:

To grab everything RSAT-related in one shot instead of running a dozen separate commands, pipe the two cmdlets together:

Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability -Online

That installs every RSAT capability Microsoft currently ships for Windows 11 — more than most single workstations need, but useful for a jump box that has to touch everything.

A few of these capabilities carry declared dependencies. Add the AD DS and LDS Tools and Server Manager installs alongside it. Add Failover Clustering Tools and File Services Tools comes with it. That’s expected packaging behavior, not a broken install — if Add-WindowsCapability reports success but a dependent console still won’t launch, check whether the dependency actually landed before troubleshooting the console itself.

If you’re scripting this into an image build rather than a one-off install, DISM does the identical operation:

DISM /Online /Add-Capability /CapabilityName:Rsat.Dns.Tools~~~~0.0.1.0

Add-WindowsCapability is a PowerShell wrapper around the same DISM engine, so use whichever fits your existing tooling.

When RSAT won’t install on a managed device

On a personal or unmanaged PC, this whole process takes under a minute. On a domain-joined machine pointed at WSUS, it’s common for the Optional Features page to hang on “Installing,” time out, or leave a capability in a state that PowerShell won’t cleanly report as either Installed or NotPresent.

The cause is almost always the same: WSUS does not serve Feature on Demand content by default. RSAT capabilities come from Windows Update or a Features-on-Demand source, and if the client’s only configured update source is your WSUS server, there’s nothing there to install from. The client isn’t being blocked so much as asking the wrong place for content that was never synced to it.

I’d confirm that pattern before changing any policy. If Get-WindowsCapability shows the tool as NotPresent and the install attempt errors out referencing a source or fails to complete, that’s consistent with a missing FOD source rather than a corrupted client.

The fix is one Group Policy setting: Computer Configuration > Administrative Templates > System > Specify settings for optional component installation and component repair. Enable it, then set “Download repair content and optional features directly from Windows Update instead of Windows Server Update Services (WSUS)” to Enabled. Run gpupdate /force and retry the install. This doesn’t pull regular patching away from WSUS — it only lets the client reach Windows Update for the specific content WSUS doesn’t carry.

For machines that genuinely can’t reach the internet, point the same policy at an internal source instead: set the alternate source file path to a network share or a mounted install.wim (wim:\\server\share\install.wim:3 syntax), and leave “Never attempt to download payload from Windows Update” enabled so the client doesn’t try Windows Update first. That share needs the matching Windows 11 Features on Demand media for your exact build — a version mismatch is the next most common failure after the WSUS issue itself.

Worth flagging separately: Windows 11, version 25H2 on Arm64 doesn’t support RSAT as Features on Demand at all. A handful of tools — AD DS and LDS Tools, AD Certificate Services Tools, Server Manager, Group Policy Management, DNS, and DHCP — are available instead through the older Control Panel > Programs and Features > Turn Windows features on or off dialog. If your fleet mixes x64 and Arm64 hardware, the same PowerShell script won’t cover both.

If you’re setting this up once on your own machine, Settings is the fastest path and the dependency chain resolves itself automatically. If you’re rolling it out to more than a handful of machines, script it with Add-WindowsCapability and check the WSUS policy first — it’s the single most common reason RSAT “doesn’t work” on a Windows 11 machine that’s otherwise fine.

Frequently Asked Questions

References

Microsoft — Install and Manage Remote Server Administration Tools in Windows https://learn.microsoft.com/en-us/windows-server/administration/install-remote-server-administration-tools

Microsoft — Available Features on Demand (Remote Server Administration Tools section) https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod

Read more: Microsoft 365 Intune Remote Help Now Supports Unattended Windows Access