Installing RSAT-AD-Tools for AD DS Management
Short answer
A Install-WindowsFeature RSAT-AD-Tools installs the Remote Server Administration Tools required to manage AD DS entities like password policies from a member server.
Question
You need to ensure that you can manage password policies for the domain from Server1.
Which command should you run first on Server1?
Key Takeaways
The trap is confusing Group Policy management (GPMC) with AD DS object management (RSAT-AD-Tools); password policies, especially Fine-Grained ones, require direct AD DS tooling.
Learn how to enable AD DS management on a member server by installing the correct RSAT feature. This page explains why RSAT-AD-Tools is the prerequisite for managing password policies.
Common mistake: Choosing GPMC because default domain password policies are stored in Group Policy. However, GPMC only edits GPOs; it cannot create or assign Fine-Grained Password Policies or manage AD user/computer objects directly.
Expert Analysis
To manage Active Directory Domain Services (AD DS) from a member server, you must install the Remote Server Administration Tools (RSAT). The specific feature required depends on whether you are using graphical tools or PowerShell. Since the goal is to manage password policies—which involves configuring Fine-Grained Password Policies (FGPP)—you need access to AD DS management capabilities. The RSAT-AD-Tools package includes the core AD DS tools, such as the Active Directory Administrative Center and command-line utilities necessary for this task. While GPMC (Group Policy Management Console) is used to edit Group Policy Objects that can enforce default domain password policies, it does not provide the direct AD DS object manipulation needed for FGPPs. RSAT-AD-PowerShell is part of the broader RSAT suite but RSAT-AD-Tools is the standard meta-package referenced for general AD management on Windows Server. RSAT-ADRMS is unrelated to AD DS management.
The key distinction here is between managing via Group Policy (default domain policy) versus managing AD objects directly (Fine-Grained Password Policies). The question asks to "manage password policies," which in modern AD environments often implies FGPPs managed via AD Administrative Center or PowerShell cmdlets included in RSAT-AD-Tools. Installing RSAT-AD-Tools provides the necessary snap-ins and tools to interact with AD DS objects directly.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
When asked about managing AD DS objects from a remote server, always look for RSAT features first. Distinguish between 'managing policies' via GPOs (GPMC) and 'managing AD objects/settings' (RSAT-AD-Tools). For tasks involving Fine-Grained Password Policies or direct user/group management, RSAT-AD-Tools is the foundational requirement.
Frequently Asked Questions
Why not GPMC?
What does RSAT-AD-Tools include?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
advisor13 👍 1 Answered ARSAT-AD-Tools installs the core Active Directory management tools (including the Active Directory Administrative Center and AD DS snap-ins/command-line tools) on a member server. This is required to manage both standard domain password settings and Fine-Grained Password Policies (FGPP). While GPMC (Install-WindowsFeature GPMC) is used specifically for managing Group Policy Objects (like the Default Domain Policy), RSAT-AD-Tools provides the broader, comprehensive administrative framework required for full Active Directory user, computer, and policy management from a remote server.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All AZ-802 Questions
Access 125 questions with complete answers and detailed explanations.
View Full AZ-802 Practice Test →