How to Add Active Directory Users and Computers (ADUC) to Your Windows System

Active Directory Users and Computers — commonly abbreviated as ADUC — is a Microsoft Management Console (MMC) snap-in used to manage users, groups, computers, and other objects within an Active Directory (AD) domain. If you're setting up a new workstation or managing a Windows Server environment, knowing how to install and access ADUC is a foundational IT skill.

What Is Active Directory Users and Computers?

ADUC is an administrative tool that lets you:

• Create and manage user accounts and security groups
• Join or remove computer objects from a domain
• Set organizational units (OUs) for policy delegation
• Reset passwords, disable accounts, and manage permissions

It lives inside the Remote Server Administration Tools (RSAT) package on client machines, or it's available natively on Windows Server installations. The tool itself doesn't run on a server — it communicates with a domain controller over the network.

Where ADUC Lives Depends on Your System

This is the first variable most people run into. Where you install or access ADUC depends entirely on what OS you're running:

Windows Home editions cannot run RSAT tools at all. If you're on a Home edition and need ADUC access, the path forward typically involves upgrading the OS edition or managing AD from a different machine.

How to Add ADUC on Windows 10 or Windows 11 (Pro/Enterprise) 🖥️

On modern Windows client machines, ADUC is installed as part of the RSAT feature set through Windows Settings:

1. Open Settings → Apps → Optional Features
2. Click Add a feature (or View features in Windows 11)
3. Search for "RSAT: Active Directory Domain Services and Lightweight Directory Tools"
4. Select it and click Install
5. Once installed, open the Start menu and search for "Active Directory Users and Computers"

No reboot is typically required. The tool will appear under Windows Administrative Tools in the Start menu.

Alternatively, you can install it via PowerShell with elevated privileges:

Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0" 

This method is useful for scripted deployments or remote provisioning.

How to Add ADUC on Windows Server

On a Windows Server machine that's been promoted to a domain controller, ADUC installs automatically as part of the Active Directory Domain Services (AD DS) role.

If you're on a member server (not a domain controller) and need ADUC:

1. Open Server Manager → Manage → Add Roles and Features
2. Choose Role-based or feature-based installation
3. Under Features, expand Remote Server Administration Tools → Role Administration Tools → AD DS and AD LDS Tools
4. Check Active Directory Users and Computers and complete the wizard

This approach is common in environments where administrators manage AD from dedicated admin workstations rather than directly on the domain controller.

Key Variables That Affect Your Installation Path

Getting ADUC working isn't just about clicking install. Several factors shape what works for your setup:

Network connectivity — ADUC needs to reach a domain controller over the network. If the machine isn't joined to the domain or can't resolve the domain via DNS, the tool will open but won't connect to anything useful.

Domain membership — The workstation you're installing ADUC on doesn't have to be a domain controller, but it does need to be a domain-joined machine (or you'll need to manually specify domain credentials when connecting).

User permissions — Installing RSAT requires local administrator rights. Using ADUC to create or modify domain objects requires appropriate Active Directory permissions — typically delegated admin rights or Domain Admin membership.

Windows edition — As noted above, Home editions block RSAT entirely. Pro, Enterprise, and Education editions support it.

Windows version — Older RSAT packages (pre-Windows 10 1809) were separate downloadable .msi files rather than optional features. If you're on a legacy system, the installation path is different.

What You Can Do Once ADUC Is Installed 🔑

Once the snap-in is open and connected to your domain, the main tasks it supports include:

• Creating new user accounts — right-click on an OU → New → User
• Resetting passwords — right-click a user object → Reset Password
• Moving objects between OUs — drag and drop or right-click → Move
• Adding computers to the domain — computer objects appear here once a machine joins the domain
• Managing group membership — add users to security or distribution groups
• Enabling or disabling accounts — right-click → Enable/Disable Account

Each of these actions touches the underlying LDAP directory on the domain controller in real time.

The Setup That Works Varies More Than It Seems

Most walkthroughs treat ADUC installation as a simple checklist, and for straightforward environments it is. But the reality across different organizations varies widely — some run hybrid environments with Azure AD Connect alongside on-premises AD, some have strict Group Policy settings that restrict feature installation, and others run heavily segmented networks where ADUC connectivity requires VPN access or specific firewall rules to port 389 (LDAP) or 636 (LDAPS).

Whether the standard install path is enough, or whether you're dealing with additional network, permission, or compatibility layers, depends entirely on how your environment is structured — and that's something only your specific setup can answer.