Install RSAT on Windows 11: 5 Methods, Including Offline

To install RSAT on Windows 11, you add the Remote Server Administration Tools as Features on Demand through Settings, PowerShell or DISM; there is no separate download any more. RSAT gives you Active Directory Users and Computers, Group Policy Management, DNS, DHCP, Failover Cluster Manager and the matching PowerShell modules on your admin workstation, so you can manage Windows Server 2016 to 2025 without signing in to the servers. This guide covers every method, the WSUS error 0x800f0954, offline installation, ARM64 devices, verification, removal and the Windows Server equivalents.

Short answer: Open PowerShell as administrator and run Get-WindowsCapability -Name RSAT* -Online | Where-Object State -eq 'NotPresent' | Add-WindowsCapability -Online to install all RSAT tools, or pick them in Settings » System » Optional features » View features. If the install fails with 0x800f0954 on a WSUS-managed PC, enable the option to download optional features directly from Windows Update and try again.

Which method to use

Method	Best for	Needs	Notes
Settings » Optional features	One PC, a few tools	Internet access to Windows Update	Simplest; progress shown in Settings
PowerShell Add-WindowsCapability	All tools at once, scripts	Admin PowerShell	Can install every RSAT tool in one line
DISM /Add-Capability	Task sequences, batch files, offline images	Admin command prompt	Same result; works with /Source and /LimitAccess
Offline from the Languages and Optional Features ISO	No internet, air-gapped or strict WSUS networks	ISO matching the Windows 11 version	No Windows Update traffic
Windows Server Install-WindowsFeature	Management servers, jump hosts	Windows Server 2016 to 2025	RSAT is a server feature, not a capability

Prerequisites

• Windows 11 Pro, Enterprise or Education. Windows 11 Home does not offer RSAT.
• A local administrator account or an elevated PowerShell or command prompt.
• Access to Windows Update, or to a Features on Demand source that matches your Windows 11 version.
• An x64 PC for the full set. On ARM64 only some tools are available (see below).
• For domain tools, the PC joined to the domain or able to reach a domain controller with suitable credentials.

RSAT tools and capability names

Each tool is a separate capability. You can install RSAT on Windows 11 one tool at a time and add more later.

Capability name	What you get
Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0	Active Directory Users and Computers, Sites and Services, Domains and Trusts, ADSI Edit, Active Directory Administrative Center, the ActiveDirectory module
Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0	Group Policy Management Console, editor and the GroupPolicy module
Rsat.Dns.Tools~~~~0.0.1.0	DNS Manager, dnscmd.exe, the DnsServer module
Rsat.DHCP.Tools~~~~0.0.1.0	DHCP console, netsh context and the DhcpServer module
Rsat.ServerManager.Tools~~~~0.0.1.0	Server Manager
Rsat.FailoverCluster.Management.Tools~~~~0.0.1.0	Failover Cluster Manager and Cluster-Aware Updating
Rsat.FileServices.Tools~~~~0.0.1.0	File Services tools, including DFS Management
Rsat.CertificateServices.Tools~~~~0.0.1.0	Certification Authority and related AD CS consoles
Rsat.BitLocker.Recovery.Tools~~~~0.0.1.0	BitLocker recovery password viewer in AD
Rsat.RemoteDesktop.Services.Tools~~~~0.0.1.0	RD Licensing Manager and RD Gateway Manager
Rsat.WSUS.Tools~~~~0.0.1.0	WSUS console and the UpdateServices module
Rsat.VolumeActivation.Tools~~~~0.0.1.0	Volume Activation Tools for KMS

Other capabilities cover IPAM, Network Load Balancing, Remote Access, Storage Replica, Storage Migration Service, Network Controller, LLDP, Shielded VM tools, System Insights and Azure Stack HCI.

Choose tools by role

Installing every tool on every admin PC is convenient, but a smaller set keeps consoles tidy and updates faster. Typical sets:

Role	Tools
Service desk	AD DS and LDS tools, BitLocker recovery tools, Group Policy Management (to read reports)
Server and infrastructure team	Server Manager, AD DS, Group Policy, DNS, DHCP, File Services, Failover Clustering
Network team	DNS, DHCP, IPAM client, Remote Access management
PKI and update administrators	Certificate Services tools, WSUS tools, Volume Activation tools

RSAT only provides the consoles and modules. What a user can change still depends on their rights in Active Directory, so installing the tools does not give the service desk any extra permissions.

Method 1: Settings

1. Open Settings » System » Optional features.
2. Next to Add an optional feature, select View features.
3. Type RSAT in the search box.
4. Tick the tools you need, for example RSAT: Active Directory Domain Services and Lightweight Directory Services Tools and RSAT: Group Policy Management Tools, then select Next and Add (or Install).
5. Wait until each item shows as installed on the Optional features page. No restart is normally needed.

The old Turn Windows features on or off dialog in Control Panel is not used for RSAT on x64 Windows 11, and the standalone RSAT download packages only exist for Windows 10 releases before 1809.

Method 2: PowerShell

PowerShell is the fastest way to install RSAT on Windows 11 when you want several tools. Open Terminal (Admin) or Windows PowerShell as administrator.

List the tools and their state

Get-WindowsCapability -Name RSAT* -Online | Select-Object -Property DisplayName, Name, State

Install one tool

Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0"

Install a typical admin set

$tools = @(
  "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0",
  "Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0",
  "Rsat.Dns.Tools~~~~0.0.1.0",
  "Rsat.DHCP.Tools~~~~0.0.1.0",
  "Rsat.ServerManager.Tools~~~~0.0.1.0"
)
foreach ($t in $tools) { Add-WindowsCapability -Online -Name $t }

Install every RSAT tool

Get-WindowsCapability -Name RSAT* -Online |
  Where-Object State -eq 'NotPresent' |
  Add-WindowsCapability -Online

The full set takes several minutes and downloads a few hundred megabytes. Check the RestartNeeded field of the output; it is usually False.

Method 3: DISM

DISM does the same job from a command prompt, which suits batch files and task sequences:

DISM /Online /Get-Capabilities /Format:Table | findstr /i "Rsat"
DISM /Online /Add-Capability /CapabilityName:Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0
DISM /Online /Add-Capability /CapabilityName:Rsat.Dns.Tools~~~~0.0.1.0

DISM writes its log to C:\Windows\Logs\DISM\dism.log, and servicing details go to C:\Windows\Logs\CBS\CBS.log.

Fix error 0x800f0954 on WSUS-managed PCs

When a PC gets updates from WSUS, it also asks WSUS for Features on Demand. WSUS does not serve those payloads, so Settings shows Couldn’t install and PowerShell or DISM fail with 0x800f0954. Allow the PC to fetch optional features directly from Windows Update:

1. In a GPO linked to your admin workstations (or in gpedit.msc for a single PC) go to Computer Configuration » Policies » Administrative Templates » System.
2. Open “Specify settings for optional component installation and component repair” and choose Enabled.
3. Tick “Download repair content and optional features directly from Windows Update instead of Windows Server Update Services (WSUS)”. Make sure “Never attempt to download payload from Windows Update” is not ticked.
4. Run gpupdate /force and repeat the install.

The policy writes RepairContentServerSource = 2 (REG_DWORD) to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Servicing. Normal quality updates keep coming from WSUS. If the network blocks Windows Update entirely, use the offline method instead, or set Alternate source file path in the same policy to a share that holds the Features on Demand files.

Deploy RSAT to many admin PCs

To install RSAT on Windows 11 across a team, run the same capability list from a script that is safe to repeat:

$caps = @(
  "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0",
  "Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0",
  "Rsat.Dns.Tools~~~~0.0.1.0"
)
foreach ($c in $caps) {
  if ((Get-WindowsCapability -Online -Name $c).State -ne 'Installed') {
    Add-WindowsCapability -Online -Name $c | Out-Null
  }
}

• Group Policy: run it as a computer startup script in a GPO linked to the admin workstation OU, together with the optional component policy from the section below.
• Intune: add it under Devices » Scripts and remediations » Platform scripts, set Run this script using the logged on credentials to No so it runs as SYSTEM, and Run script in 64 bit PowerShell Host to Yes. Intune-managed PCs that use Windows Update for Business download the tools directly.
• Configuration Manager: deploy the script as an application or a task sequence step; with the offline source, add -Source and -LimitAccess.

After a Windows 11 feature update, run the verification commands again and reinstall any tool that reports NotPresent.

Method 4: Offline from the Languages and Optional Features ISO

For air-gapped networks, install RSAT on Windows 11 from the Languages and Optional Features ISO, which you get from volume licensing downloads or a Visual Studio subscription. RSAT is on that ISO, not on the separate Features on Demand 2 ISO. The ISO must match the Windows 11 version you are installing on.

1. Copy the ISO to the PC or to a share and mount it:
   

   Mount-DiskImage -ImagePath "C:\ISO\Win11_LanguagesAndOptionalFeatures.iso"

2. Note the drive letter (here E:) and point the install at the folder that holds the .cab files:
   

   Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0" -Source "E:\LanguagesAndOptionalFeatures" -LimitAccess

3. Or with DISM:
   

   DISM /Online /Add-Capability /CapabilityName:Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0 /Source:E:\LanguagesAndOptionalFeatures /LimitAccess

-LimitAccess stops Windows from contacting Windows Update or WSUS. For many PCs, copy the folder to a read-only share such as \\fs01\FoD\Win11 and use it as the source, or set it as the Alternate source file path in the policy above.

ARM64 devices

RSAT Features on Demand are not supported on Arm64. On Windows 11 version 25H2 for Arm64, some tools are instead available in Control Panel » Programs » Programs and Features » Turn Windows features on or off:

• RSAT: Active Directory Domain Services and Lightweight Directory Services Tools
• RSAT: Active Directory Certificate Services Tools
• RSAT: Server Manager
• RSAT: Group Policy Management Tools
• RSAT: DNS Server Tools
• RSAT: DHCP Server Tools

For other tools on Arm64, use a management server or Windows Admin Center.

Windows Admin Center as an alternative

Windows Admin Center is a browser-based console installed on a gateway server. It covers many day-to-day server tasks, such as services, event logs, files, updates and roles, without any RSAT tools on the client. It does not replace every MMC console, so most administrators still install RSAT on Windows 11 for Active Directory and Group Policy work.

Windows Server equivalents

On Windows Server 2016 to 2025, RSAT tools are Windows features:

Get-WindowsFeature -Name RSAT*
Install-WindowsFeature -Name RSAT-AD-Tools -IncludeAllSubFeature
Install-WindowsFeature -Name GPMC, RSAT-DNS-Server, RSAT-DHCP, RSAT-Clustering
Install-WindowsFeature -Name RSAT -IncludeAllSubFeature

The last line installs every administration tool. On Server Core only the PowerShell modules are useful, because the MMC consoles need the Desktop Experience.

Secure the admin workstation

RSAT turns a PC into a management station, so treat it like one:

• Install the tools on dedicated admin workstations rather than on every user’s laptop, and sign in to them with separate admin accounts.
• Do not browse the web or read email with the account that manages Active Directory.
• Delegate only the rights each team needs, for example password resets for the service desk, instead of adding people to Domain Admins.
• Keep the PC on the current Windows 11 version. The tools are serviced with the monthly cumulative updates, so there is nothing separate to patch.
• Restrict who can sign in to admin workstations with a GPO and audit logons to them.

Verify it works

1. List what is installed:
   

   Get-WindowsCapability -Name RSAT* -Online | Where-Object State -eq 'Installed' | Select-Object DisplayName

2. Check the modules: Get-Module -ListAvailable ActiveDirectory, GroupPolicy, DnsServer, DhcpServer.
3. Test a query: Get-ADDomain or Get-GPO -All | Select-Object -First 5 DisplayName.
4. Open the consoles from Start » All apps » Windows Tools or run dsa.msc, gpmc.msc, dnsmgmt.msc and dhcpmgmt.msc.

Troubleshooting

If you cannot install RSAT on Windows 11, match the error to the table:

Symptom	Cause	Fix
0x800f0954	PC points at WSUS, which does not host FoD	Enable the optional component policy with the Windows Update option
0x800f081f, source files not found	Offline source missing or for a different Windows version	Use the matching Languages and Optional Features ISO and the correct folder
No RSAT entries in Settings	Windows 11 Home, or an Arm64 device	Upgrade the edition; on Arm64 use Windows Features
Install stuck or pending	A pending update or restart, or a busy servicing stack	Restart, install pending updates, then retry
Consoles open but fail to connect	Firewall, DNS or permissions on the server side	Test Test-NetConnection dc01 -Port 389 and run the console as a domain admin
Access denied during install	Shell not elevated	Run PowerShell or Command Prompt as administrator
Installed, but no shortcut in Start	Consoles are grouped in the Windows Tools folder	Open Windows Tools or start the .msc file directly
Module not found in PowerShell 7	Old session opened before the install	Open a new session; import with Import-Module ActiveDirectory

For deeper analysis, search dism.log and CBS.log for the capability name. Component store corruption can also block Features on Demand; repair it with DISM /Online /Cleanup-Image /RestoreHealth first.

Uninstall RSAT tools

• Settings: Settings » System » Optional features, expand the tool under installed features and select Remove.
• PowerShell: Remove-WindowsCapability -Online -Name "Rsat.Dns.Tools~~~~0.0.1.0".
• DISM: DISM /Online /Remove-Capability /CapabilityName:Rsat.Dns.Tools~~~~0.0.1.0.
• Windows Server: Uninstall-WindowsFeature -Name RSAT-DNS-Server.

If a removal fails because another RSAT tool depends on it, remove the dependent tool first. When you install RSAT on Windows 11 for a team, script the same capability list for every admin PC so the consoles and module versions stay consistent.

Install RSAT on Windows 11 at a glance

Official documentation: Remote Server Administration Tools (RSAT) for Windows, Available Features on Demand (non-language), Configure a Windows repair source.

Related guides: Install Active Directory on Windows Server 2025: New Forest Step by Step · WSUS Windows Server 2025: Reliable Install and Configuration · DISM RestoreHealth Offline Source: Proven Windows 11 Repair.

Frequently asked questions