How to Access Active Directory on Windows 11

To access Active Directory on Windows 11, add Microsoft’s Active Directory management tools as an optional feature, then open them from the Start menu. Right-click Start, select Settings > System > Optional features, select View features, add RSAT: Active Directory Domain Services and Lightweight Directory Services Tools, and then open Active Directory Users and Computers from Windows Tools.

Applies to: Windows 11 Pro and Enterprise.

What “accessing Active Directory” means on a Windows 11 PC

Active Directory Domain Services (AD DS) is Microsoft’s directory service. A directory is a hierarchical structure that stores information about objects on a network, such as user accounts, passwords, computers, printers and shared folders. That directory lives on Windows Server machines called domain controllers, not on your Windows 11 PC.

So a Windows 11 computer never “has” Active Directory. What you can do from it is one of two things:

• Manage the directory. Install the Remote Server Administration Tools (RSAT) for Active Directory, which give you consoles such as Active Directory Users and Computers. This is what most people mean, and it is the main method below.
• Sign in to a domain. Join the PC to your organization’s domain so domain accounts can sign in on it. That is a separate task, covered briefly near the end.

The tools only display and change what your account is allowed to see and change. Installing them does not give you any new rights in the directory.

Before you start

• Windows 11 Pro or Enterprise. RSAT can be installed only on Professional or Enterprise editions of Windows, not on Home edition. To check, right-click Start, choose Settings, select System, pick About, and look under Windows specifications.
• Administrator rights on the PC. You need administrative privileges on the computer where RSAT is installed.
• An internet connection. Windows Update downloads the feature, so the device has to be online. The Active Directory tools take about 17 MB.
• A domain to manage. You need network connectivity to the Windows Server systems you want to manage, plus an account with rights on them. Without a domain controller to connect to, the consoles open but have nothing to show.

You do not need to download an installer. Since the Windows 10 October 2018 Update, RSAT has been included in Windows as a set of Features on Demand, and that is still how Windows 11 delivers it. Still on Windows 10? Opening Active Directory Users and Computers in Windows 10 covers that system. Still on Windows 10? The Settings screens differ slightly there, so follow the Windows 10 RSAT install steps instead.

Install the Active Directory tools from Settings

1. Right-click the Start menu and select Settings. The Settings app opens.
2. Select System.
3. Select Optional features. You see a list of features that are already installed. You can also get here by selecting Start and typing Optional Features in the search box.
4. Select the View features button next to Add an optional feature. A window titled Add an optional feature opens with a list of everything you can add.
5. Find RSAT: Active Directory Domain Services and Lightweight Directory Services Tools and select the box next to it. Typing RSAT or Active Directory in the search field shortens the list. There are several RSAT entries with similar names, so read the full name before you check the box.
6. Select Next, review the list of selected features, and then select Add. Some Microsoft instructions label this last button Install; it does the same thing.
7. Wait while Windows downloads and installs the feature. Review the installation progress. When it finishes, the tools are listed under Installed features.

If you also need the other server tools, such as the ones for DNS or Group Policy, add their RSAT entries from the same list. Microsoft’s own instructions are in Install Remote Server Administration Tools and Add, remove, or hide Windows features.

Open Active Directory Users and Computers

Once the feature is installed, you can reach the tools by selecting Windows Tools from the Start menu. Windows Tools is a folder of administrative programs; the Active Directory consoles appear in it alongside the tools that were already there.

1. Select Start and open Windows Tools. If you do not see it right away, type Windows Tools in the Start search box.
2. Open Active Directory Users and Computers. The console opens and connects to your domain.
3. Select your domain in the left pane, then a container such as Users, to see the accounts stored there.

There are faster routes once you know the file names:

Tool	What to type in the Run dialog	What it is for
Active Directory Users and Computers	dsa.msc	The classic console for everyday work with users, groups and computer accounts
Active Directory Administrative Center	dsac.exe	A newer console that adds the Active Directory Recycle Bin, fine-grained password policies and a PowerShell history viewer

Type the name, then select OK.

Which console should you use?

For looking up a user, checking group membership or finding a computer account, Active Directory Users and Computers is the tool most instructions refer to. Choose the Active Directory Administrative Center when you need one of its extra features: restoring deleted objects from the Active Directory Recycle Bin, creating fine-grained password policies for specific users or groups, or viewing the PowerShell commands the console runs so you can reuse them in scripts. The Administrative Center needs Active Directory Web Services running on at least one domain controller it can reach.

Open a console with a different account

Many organizations give administrators a separate admin account. To start the Administrative Center under that account while you stay signed in to Windows with your normal one, use the command runas /user:<domain\user> dsac, typed at a command prompt with your own domain and user name in place of the placeholder. Windows asks for that account’s password and then opens the console.

To work with another domain in the Administrative Center, select Manage > Add Navigation Nodes, select Connect to other domains, type the domain name and select OK. This works for domains in the same forest and for domains in other forests that have a trust relationship with yours.

Install the tools with PowerShell or DISM instead

The command line installs exactly the same feature. It is useful when you set up several PCs or when the Settings page is slow. Open PowerShell or Command Prompt with administrator rights first, because these commands change Windows components.

Task	PowerShell	Command Prompt (DISM)
Install	Add-WindowsCapability -Online -Name “Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0”	Dism /Online /Add-Capability /CapabilityName:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0
Check status	Get-WindowsCapability -Online -Name “Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0”	Dism /Online /Get-CapabilityInfo /CapabilityName:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0
Remove	Remove-WindowsCapability -Online -Name “Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0”	Dism /Online /Remove-Capability /CapabilityName:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

The long name is the capability name Microsoft publishes for this feature in its list of available Features on Demand. There are four tilde characters (~) in a row before the version number, so copy the name exactly. The -Online and /Online switches mean “the copy of Windows that is running now,” not “the internet.”

With no source specified, the Windows Update client downloads the package. This needs either an active internet connection or a connection to your organization’s Windows Server Update Services (WSUS) server.

Use the Active Directory PowerShell cmdlets

The same RSAT feature provides the Active Directory module for Windows PowerShell, a set of cmdlets for managing domains from the command line. A few of them:

• Get-ADDomain gets an Active Directory domain. Running it is a quick test that the PC can reach the directory.
• Get-ADUser gets one or more Active Directory users.
• Get-ADComputer and Get-ADGroup do the same for computers and groups.
• Unlock-ADAccount unlocks an account, and Set-ADAccountPassword modifies an account’s password.

The “Get” cmdlets only read information. The last two change accounts, so use them only if that is part of your job and your account has been given the right to do it.

Confirm it worked, or remove the tools

You know the install succeeded when all three of these are true: the RSAT entry appears under Installed features in Settings > System > Optional features; Active Directory Users and Computers appears in Windows Tools; and the console shows your domain when you open it.

To remove the tools later:

1. Open Settings > System > Optional features.
2. Under Installed features, type RSAT in the Search installed features box, or scroll to the entry.
3. Select the entry to expand it, and then select Remove.

Removing the tools changes nothing in the directory itself. It only takes the consoles off this PC, and you can add them again at any time with the same steps.

Troubleshooting

The RSAT entry is not in the list

Check the edition first under Settings > System > About > Windows specifications. On Windows 11 Home the feature cannot be installed, and there is no supported workaround; the PC would need a Pro or Enterprise edition. Do not download “Active Directory” installers from other websites. Microsoft delivers these tools only through Windows itself.

Also look under Installed features. If the entry is there, the tools are already on the PC and Windows will not offer them a second time.

You have an Arm-based PC

Windows 11, version 25H2 on Arm64-based devices is an exception: there the RSAT Features on Demand are not supported. Instead, go to Control Panel > Programs > Programs and Features > Turn Windows features on or off. The Active Directory Domain Services and Lightweight Directory Services Tools are among the RSAT components currently available that way, along with the tools for Group Policy, DNS, DHCP, certificate services and Server Manager.

The Optional features page is missing or you cannot add features

On a work or school PC, your organization may have turned this off. A Group Policy setting named Hide “Windows Features” hides the settings page for adding optional features. You cannot change that yourself on a managed device. Ask your IT department to install the tools or to grant you the access.

The download fails or never finishes

The feature comes from Windows Update, so confirm that the PC is online and that Windows Update itself works. On a company network the PC may be set to get updates from an internal WSUS server or from a location set by Group Policy; if that source does not carry the RSAT package, the install fails even though the internet connection is fine. That is something only your IT department can correct.

The console opens but shows an error or no domain

The tools talk to domain controllers over the network. Make sure you are on the company network, or connected to its VPN if you work remotely, and that you are using an account from that domain. The Administrative Center also requires Active Directory Web Services on a reachable domain controller. If you can see objects but options are unavailable or changes are refused, your account lacks the permission for that action, and a domain administrator has to grant it.

If you want to join the PC to a domain instead

If your goal is to sign in with a work account rather than to manage the directory, you need to join the computer to the domain. In Settings, the route is Start > Settings > Accounts > Access work or school > Connect > Join this device to a local Active Directory domain. You then enter the domain name, select Next, enter the account credentials you were given, and restart the device. Pro, Enterprise, Pro Education and Pro for Workstations editions can join a domain, and the account you use needs administrative privileges on the PC. Home cannot.

Adding a computer to a domain in Windows 11 goes through that process. If you are not sure whether the PC is already a member, finding the domain name on Windows 11 shows how to check.

Frequently asked questions

Can I use Active Directory on Windows 11 Home?

No. RSAT cannot be installed on Home edition, and Home is not among the editions that can join a domain. You need Windows 11 Pro or Enterprise.

Does installing RSAT turn my PC into a domain controller?

No. The feature is a set of tools for remotely managing AD DS and AD LDS on Windows Server. The directory stays on the servers; your PC only gets the consoles and PowerShell cmdlets that connect to it.

Do I need to be a domain administrator?

You need administrator rights on your own PC to install the tools. What you can do afterward depends on your domain account, which needs administrative privileges on the remote servers for the service you want to manage. Many organizations give help desk staff limited rights, for example for password resets only.

Do I need to download RSAT from Microsoft’s website?

No. On Windows 11 the tools are built in as optional features and are added from Settings, PowerShell or DISM. Windows downloads the files through Windows Update.

Where did Administrative Tools go?

Older instructions say to open Active Directory Users and Computers from Administrative Tools. In Windows 11, they are in Windows Tools on the Start menu instead.

What is the difference between Active Directory Users and Computers and the Administrative Center?

Both manage the same directory. Users and Computers (dsa.msc) is the long-standing console. The Administrative Center (dsac.exe) adds the Recycle Bin for restoring deleted objects, fine-grained password policies and the PowerShell history viewer. Microsoft’s Active Directory Administrative Center documentation describes those features in detail.

Once the console opens and shows your domain, you are set. If it does not, check the edition and the network connection first, then ask your domain administrator to confirm what your account is allowed to do.