How to Access Active Directory Users and Computers (ADUC)

AvatarByEric Dawson Computers & Software

To access Active Directory Users and Computers, press Windows+R, type dsa.msc, and press Enter. On a domain controller the console is already installed; on a Windows 11 or Windows 10 Pro or Enterprise PC you first add the optional feature called RSAT: Active Directory Domain Services and Lightweight Directory Services Tools, either from Settings or with one PowerShell command, and the console then appears under Windows Tools in the Start menu. Your PC must be joined to the domain, and you need an account with rights to manage it. The sections below give the exact clicks for each Windows version, the commands, and the fixes for the usual reasons the tool can’t be found.

Where Active Directory Users and Computers Lives on a Windows PC

Active Directory Users and Computers (ADUC) is a Microsoft Management Console snap-in, and its file is dsa.msc in C:\Windows\System32. It’s not a separate app you download. Microsoft ships it as part of the Remote Server Administration Tools (RSAT), which Microsoft Learn describes as a collection of utilities that let IT staff manage Windows Server roles and features from a Windows client computer. A domain controller therefore has the console from day one, because the AD DS tools install alongside the role. On a workstation you add it yourself.

Since Windows 10 version 1809 (the October 2018 Update), RSAT has been built into the operating system as a Feature on Demand rather than a downloadable installer. Microsoft’s support article KB 2693643, updated February 2026, states that RSAT for 1809 and later is part of the operating system and is added through Optional Features, while the old MSU download applies only to earlier builds. That article is equally direct about editions: you can’t install RSAT on Home editions, only on Professional or Enterprise. This single fact explains a large share of the “where is Active Directory Users and Computers” searches, because the feature isn’t offered on Windows 11 Home at all.

Microsoft Learn’s Features on Demand catalog, updated February 2026, lists the exact package. Its capability name is Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0, its install size is about 17 MB, and it depends on Rsat.ServerManager.Tools, which Windows pulls in automatically. That one package carries far more than ADUC. According to the KB 2693643 tool matrix, the AD DS and AD LDS bundle includes Active Directory Administrative Center, Active Directory Domains and Trusts, Active Directory Sites and Services, ADSI Edit, the Active Directory module for Windows PowerShell, and command-line tools such as dcdiag, repadmin, ntdsutil, and dsquery.

How to Add Active Directory Users and Computers on Windows 11

To add Active Directory Users and Computers on Windows 11 Pro or Enterprise, install the RSAT: Active Directory Domain Services and Lightweight Directory Services Tools feature through Settings, PowerShell, or an offline ISO. All of them need a local administrator account and, unless you have offline media, a working path to Windows Update, because the payload isn’t stored on the disk until you ask for it.

Through Settings and Optional Features

Microsoft’s RSAT install guide on Microsoft Learn, dated August 2025, gives this sequence for Windows 11:

  1. Open the feature list: Select Start, type Optional features, and choose Add an optional feature. The same page is reachable through Settings, System, Optional features.
  2. Check what’s already there: Scan the Installed features list for anything that starts with RSAT.
  3. View features: At the top of the page, select View features next to Add an optional feature.
  4. Search: Type RSAT in the search box to filter the long list.
  5. Pick the package: Tick RSAT: Active Directory Domain Services and Lightweight Directory Services Tools, select Next, then select Install.
  6. Wait for the download: Progress shows under Recent actions. No restart is normally required; Microsoft’s own sample output for this install shows RestartNeeded: False.

The University of Wyoming’s IT knowledge base, revised October 2025, documents the same route for its staff (Settings, System, Optional features, Add an optional feature, search for RSAT) and adds a practical tip. Once installed, search Start for Active Directory Users and Computers, choose Open file location, and create a desktop shortcut from the Windows Tools folder so you’re not hunting for it next week.

With One PowerShell Command

Open Windows PowerShell or Terminal as an administrator (right-click Start and choose Terminal (Admin)). Check the current state first with the command Microsoft Learn documents:

Get-WindowsCapability -Online | Where-Object Name -like ‘RSAT*’

Every RSAT package appears with a State of NotPresent or Installed. Then install the Active Directory tools:

Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

Microsoft Learn shows the expected result as Online: True and RestartNeeded: False. To grab every RSAT console at once, which many admins prefer on a dedicated management PC, pipe one command into the other: Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability -Online. That pulls DNS, DHCP, Group Policy, clustering, and file services consoles as well, so it takes longer and only makes sense on a machine you’ll manage from.

From the Languages and Optional Features ISO When There’s No Internet

Some admin workstations can’t reach Windows Update at all. Microsoft’s Features on Demand documentation says the Windows 11 packages ship as .cab files on the Languages and Optional Features ISO (Windows 10 uses the Features on Demand ISO for its version), and that the ISO must match the Windows version on the PC. Mount the ISO, note its drive letter, and run this from an elevated prompt:

DISM /Online /Add-Capability /CapabilityName:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 /Source:E:\ /LimitAccess

Replace E: with the ISO’s drive letter. The /LimitAccess switch tells DISM not to try Windows Update or WSUS, and the documentation notes that /Source must point at a proper repository such as the mounted ISO, not a folder of hand-copied .cab files, because this package has satellite files and DISM needs the metadata alongside them. A mismatched ISO fails with a generic error, so confirm the build with winver before you start.

How to Install the Console on Windows 10

Install the console on Windows 10 through the same Feature on Demand used on Windows 11, reached from a slightly different Settings menu. Microsoft’s guidance for Windows 10 says to select Start, type Optional Features, choose Optional Features (labeled Manage optional features on some builds), select Add a feature, search for the tool, and select Install. KB 2693643 adds the detail that the entry sits under Settings, Apps, Optional features on builds before 22H2, and under Settings, System on 22H2 and later, which mirrors the Windows 11 layout.

The PowerShell and DISM commands are identical to Windows 11, since the capability name hasn’t changed since 1809. Builds older than 1809 are a different story: they need the separate RSAT download (KB 2693643 still links it) followed by Control Panel, Programs, Turn Windows features on or off, where the AD DS tools sit under Remote Server Administration Tools, Role Administration Tools.

One caution worth stating plainly: Microsoft ended Windows 10 support on October 14, 2025, and its support notice says devices no longer receive security updates unless they’re enrolled in the consumer Extended Security Updates program, which runs until October 12, 2027. Installing an admin console on an unpatched OS to manage a domain is a poor fit, so treat Windows 10 as a stopgap rather than a plan.

How to Access Active Directory Users and Computers Once It’s Installed

Open Active Directory Users and Computers once it’s installed by pressing Windows+R, typing dsa.msc, and pressing Enter. Four launch methods exist, and they all open the same dsa.msc.

Run the Console from the Run Box

Press Windows+R, type dsa.msc, and press Enter. Netwrix’s August 2025 guide and Dell’s OpenManage documentation both give this as the primary route, and it’s the one to memorize because it works on every Windows version, on servers, and inside a Remote Desktop session. Typing dsa.msc into the Start search box or a Command Prompt does the same thing.

From the Start Menu and Windows Tools

Select Start and type Active Directory Users and Computers; the console appears as a result you can pin to Start or the taskbar. Microsoft’s Windows Tools page, updated September 2026, explains that Windows 11 groups administrative consoles in a Control Panel folder called Windows Tools (Windows 10 calls it Administrative Tools), and that the folder’s contents vary with the edition and the features installed. Open Control Panel, switch the view to icons, pick Windows Tools, and ADUC is listed alphabetically near the top.

From Server Manager

On Windows Server, and on a client where the RSAT: Server Manager feature is installed, open Server Manager, select Tools in the top-right corner, and choose Active Directory Users and Computers. Microsoft Learn’s RSAT guide lists this as the standard launch point after any RSAT install. Because the Active Directory tools package depends on Rsat.ServerManager.Tools, a Windows 11 PC that installed ADUC will usually have Server Manager too.

As a Different User

Admins often sign in with a standard account and run the console with separate domain admin credentials. Hold Shift, right-click the Active Directory Users and Computers shortcut, choose Run as different user, and enter the admin account. The command-line equivalent is runas /user:DOMAIN\adminname “mmc dsa.msc”. Either way, the console binds to the domain with the account you supplied, and any user creation or password reset is logged under that name.

What the Console Needs Before It Will Connect

The console needs a domain-joined computer and an account with permissions to manage accounts in that domain before it will connect. Microsoft’s guide to managing user accounts with ADUC, dated June 2025, lists two prerequisites: the computer must be joined to the domain, and the account you use must have the appropriate permissions to manage accounts in that domain. By default, members of Domain Admins and Enterprise Admins can manage user, group, and computer accounts, while Account Operators can create, modify, and delete user accounts but can’t manage groups or permissions.

A PC that isn’t domain joined is the most common reason the console opens and then fails. In a Microsoft Q&A thread from August 2024, a user on Windows 11 Pro installed the feature, couldn’t get ADUC or the DNS console to open, and asked how to use them without a domain. Microsoft support staff answered that the tools exist only to manage Active Directory Domain Services and need a connection to a domain; for a standalone machine, the right tool is Local Users and Groups, reached by running lusrmgr.msc or through Computer Management (Windows+X).

DNS matters as much as membership. The console finds a domain controller through DNS service records, so a client pointed at a public resolver instead of the domain’s DNS server will report that the domain can’t be contacted even though the network is fine. Set the client’s DNS to the domain controller (or a DNS server that forwards to it) before troubleshooting anything else.

Which Install Method to Use

Use Settings, Optional features for a single Pro or Enterprise PC with no scripting, PowerShell’s Add-WindowsCapability for repeatable installs across several PCs, and DISM with an offline ISO for air-gapped PCs and imaging. Server Manager, Add Roles and Features is for member servers and jump hosts on Windows Server 2016 and later, and Control Panel’s Turn Windows features on or off is the route on Windows 11 25H2 Arm64 laptops where Settings shows nothing.

Method Where it works What you need Best for
Settings, Optional features Windows 11 and Windows 10 1809 or later, Pro or Enterprise Local admin rights, reachable Windows Update or the WSUS bypass policy One PC, no scripting
PowerShell Add-WindowsCapability Same as above Elevated PowerShell (not Command Prompt), reachable Windows Update or the WSUS bypass policy Repeatable installs across several PCs
DISM with /Source and /LimitAccess Same as above, plus offline images Languages and Optional Features ISO matching the build Air-gapped PCs and imaging
Server Manager, Add Roles and Features Windows Server 2016 and later Server administrator rights Member servers and jump hosts
Control Panel, Turn Windows features on or off Windows 11 25H2 on Arm64 (limited tool set) Local admin rights Arm laptops where the Settings route shows nothing

If Active Directory Users and Computers Still Can’t Be Found

Most failures fall into five buckets. Work through them in order; each takes a minute to rule out.

RSAT Doesn’t Appear in Optional Features

Check the edition first under Settings, System, About, Windows specifications. Home edition doesn’t list any RSAT package, and Microsoft’s KB says it can’t be installed there; the fix is an upgrade to Pro, not a workaround. If you’re on Pro or Enterprise and still see nothing, make sure you’re in the Settings app rather than the Control Panel dialog called Turn Windows features on or off, which the KB states doesn’t offer RSAT on 1809 and later. Several Microsoft Q&A threads from 2023 and 2024 end with the same discovery: the person was looking under Apps when their build had moved Optional features to System, and typing Optional features into the Settings search box took them straight there.

Error 0x800f0954 During Install

This code means Windows tried to download the payload and couldn’t. On domain PCs the cause is almost always WSUS or Configuration Manager: the client is told to get updates from an internal server, which doesn’t carry Features on Demand. A Microsoft Q&A thread from September 2020 covers exactly this on Windows 10 with SCCM acting as the WSUS server, and Microsoft’s DISM documentation describes the search order (the /Source location, then the location set by Group Policy, then Windows Update), which shows why a WSUS-pointed client stalls.

Fix It with Group Policy

  1. Open the editor: Run gpedit.msc locally, or edit the GPO that applies to the workstation.
  2. Find the setting: Computer Configuration, Administrative Templates, System, Specify settings for optional component installation and component repair.
  3. Enable it: Set it to Enabled and tick Download repair content and optional features directly from Windows Update instead of Windows Server Update Services (WSUS).
  4. Apply: Run gpupdate /force, then retry the install from Settings or PowerShell.

A Microsoft support engineer gave that exact setting as the answer in the 2020 thread, and added that WSUS itself is a poor way to deploy RSAT.

Fix It with a Temporary Registry Change

Where you can’t edit policy, the accepted answer in the same thread flips the WSUS switch for a few minutes. In an elevated PowerShell, set the UseWUServer value under HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU to 0, restart the Windows Update service, run the Add-WindowsCapability command, then set UseWUServer back to its original value (usually 1) and restart the service again. Group Policy reasserts the original value at its next refresh, so this is reasonably safe on a managed PC, but record what the value was before you change it.

Get-WindowsCapability Is Not Recognized

That message means the command was typed into Command Prompt rather than PowerShell. A September 2024 Microsoft Q&A thread, from a school admin trying to reset student passwords before term, hit this exact wall; the moderator’s answer was simply to open Windows PowerShell as administrator and run it again. In Command Prompt, the DISM equivalent works instead: DISM /Online /Add-Capability /CapabilityName:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0.

The Console Opens but Says Naming Information Cannot Be Located

The full message reads: Naming Information cannot be located because: The Server is not operational. Microsoft’s troubleshooting article KB 323542, updated February 2026, ties it to LDAP port 389 being unreachable, and its specific fix is TCP/IP filtering on the domain controller set to Permit All. In practice on a client, the same message shows up when the PC isn’t domain joined, when DNS points somewhere other than the domain, or when a firewall between the PC and the domain controller blocks port 389. Test with nltest /dsgetdc:yourdomain.com from a command prompt; if that can’t find a domain controller, ADUC won’t either.

You’re on an Arm PC

Windows on Arm handles RSAT differently. Microsoft’s KB and its Features on Demand catalog both state that on Windows 11 version 25H2 on Arm64 devices, RSAT Features on Demand aren’t supported, and a limited set (the Active Directory Domain Services tools, Certificate Services, Server Manager, Group Policy Management, DNS, and DHCP) is turned on instead through Control Panel, Programs, Programs and Features, Turn Windows features on or off. On an Arm laptop, skip Settings entirely and go there.

What to Do First Inside the Console

Enable Advanced Features on the View menu first; it’s one of two settings that make the console far more useful. On the View menu, enable Advanced Features; Microsoft’s user account guide explains that this reveals the Attribute Editor, Security, and Object tabs on every account, all hidden by default. Right-click the domain name at the top of the tree to find Change Domain Controller when you need to work against a specific DC, or Connect to Domain (Netwrix’s guide walks through it) to manage a different domain in the forest.

Creating a user follows the Action menu: select the OU, choose Action, New, User, fill in Full name and User logon name (the two required fields), set a password and the User must change password at next logon box, and select Finish. Resetting a password is Action, Reset Password, and the same dialog has an Unlock the user account box for lockouts. Microsoft recommends disabling an account before deleting it, and warns that a deleted account only comes back through the Active Directory Recycle Bin if that was enabled beforehand, or otherwise from an authoritative restore of a backup.

Frequently Asked Questions

Can I Install Active Directory Users and Computers on Windows 11 Home?

No. Microsoft’s RSAT support article states that RSAT installs only on Professional or Enterprise editions of the Windows client, and the package doesn’t appear in Home’s Optional features list. The supported path is an edition upgrade to Pro through Settings, System, Activation. Modified installers found online violate the Windows license terms, according to the same article.

Does Installing RSAT Need a Restart?

Usually not. Microsoft Learn’s sample output for Add-WindowsCapability shows RestartNeeded: False, and the console can be launched as soon as Settings reports the feature installed. If the Start menu search doesn’t find it right away, sign out and back in so the Start menu re-reads the Windows Tools folder.

Is ADUC the Same as Active Directory Administrative Center?

No, though both arrive in the same RSAT package. Active Directory Administrative Center is the newer console Microsoft lists in the AD DS tools bundle, while dsa.msc is the classic MMC snap-in most admins still reach for. Install the feature once and you get both.

Can I Remove the Tool Later?

Yes. Go back to Settings, System, Optional features, select the RSAT entry under Installed features, and choose Uninstall, or run Remove-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 from an elevated PowerShell. DISM’s documentation notes that a capability another installed package depends on can’t be removed, so remove the BitLocker Recovery tools first if you added those.

Where Is Active Directory Users and Computers on a Domain Controller?

It’s already installed. Open Server Manager, select Tools, and choose Active Directory Users and Computers, or press Windows+R and run dsa.msc. On Windows Server the console arrives with the AD DS role, so nothing extra needs to be added.

Start with the edition check, then add RSAT: Active Directory Domain Services and Lightweight Directory Services Tools from Settings or with Add-WindowsCapability, and launch dsa.msc from Run. If the feature won’t install on a work PC, error 0x800f0954 and a WSUS policy are the likely pair, and the Group Policy fix takes two minutes. Keep the PC domain joined and pointed at the domain’s DNS, sign in with an account that has rights, and the console connects on the first try.

References

Author Profile

Eric Dawson
Eric Dawson
I'm Eric Dawson, the writer behind The Money Watch. I live in the Columbus, Ohio area and I write about the ordinary questions that turn out to be complicated: computers, shopping, food, travel, parking, small businesses, fees, rules and products. Every article starts with the official page, the maker or the agency, then the sources that check it, and I say plainly where they disagree and what I would do. More about how I work is on the About page.