Máté Gelei-Szegő
Writing February 5, 2024 Updated August 11, 2026 4 min read

Install RSAT via Powershell

Note to self – I needed to install RSAT on a build agent, so using the “optional features” GUI was not possible. Turns out the PowerShell route is nicer anyway, and it’s the only sane option on anything unattended.

RSAT (Remote Server Administration Tools) is the bundle that gives you the MMC snap-ins, PowerShell modules and command-line tools for managing Windows Server roles from another machine: Active Directory Users and Computers, the ActiveDirectory module, Group Policy Management, DNS, DHCP, Failover Clustering, Server Manager and so on. Since Windows 10 1809 it isn’t a separate download – most of it ships as Features on Demand, so you install it with the *-WindowsCapability cmdlets instead of an MSU. You need Pro or Enterprise; Home doesn’t get RSAT.

List what’s available

Run an elevated PowerShell:

Get-WindowsCapability -Name RSAT* -Online | Select-Object -Property Name, State

You’ll get around twenty entries with names like Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 and a State of Installed or NotPresent. Those full names, tildes and all, are what you pass to the install cmdlet.

Install what you need

Add-WindowsCapability -Name "Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0" -Online

Or, if you genuinely want everything:

Get-WindowsCapability -Name RSAT* -Online |
    Where-Object State -eq 'NotPresent' |
    Add-WindowsCapability -Online

I’d install individual tools on a build agent. Dependencies come along automatically – the AD DS tools pull in Server Manager, the BitLocker recovery tools pull in AD DS – so you rarely need the whole set.

Two things that trip people up: not every RSAT tool is a Feature on Demand. Hyper-V Management Tools, for one, is a regular optional feature:

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-Tools-All -All

And on Windows Server none of this applies – RSAT is a normal server feature there:

Get-WindowsFeature -Name RSAT*
Install-WindowsFeature -Name RSAT-AD-Tools -IncludeAllSubFeature

When it fails

The classic is 0x800F0954, sometimes 0x8024402C or 0x80240438. Features on Demand come from Windows Update, and if the machine is pointed at WSUS it looks there instead. Domain-joined build agents hit this.

What fixes it depends on the build, which is why half the advice online doesn’t work:

  • Windows 11 22H2 and later serve FoDs from WSUS again via on-premises UUP, so there’s usually nothing to configure.
  • Windows 10 2004 through Windows 11 21H2 break when Specify settings for optional component installation and component repair is set to Windows Update while Specify source service for specific classes of Windows Updates points feature or quality updates at WSUS. Point those at Windows Update too, or leave the source selections unconfigured.
  • Older builds just need that first policy enabled with “Download repair content and optional features directly from Windows Update”.

Microsoft’s FoD and WSUS page has the full matrix.

Fully offline, grab the Features on Demand ISO for your exact Windows build and install from it. Microsoft’s guidance is to use DISM rather than the cmdlet here, since the RSAT packages have satellite packages:

DISM /Online /Add-Capability /CapabilityName:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 /Source:D:\ /LimitAccess

/LimitAccess stops the fallback to Windows Update. The ISO has to match the build – a 22H2 ISO won’t service a 23H2 machine, and the error for that is unhelpfully vague.

Verify

Get-WindowsCapability -Name RSAT* -Online | Where-Object State -eq 'Installed'

Add-WindowsCapability returns RestartNeeded : False, so no reboot. If Import-Module ActiveDirectory can’t find the module in the same session, open a new one – the module path is read at startup.