Active Directory Users and Computers (ADUC) is not installed in SCCM. Install it separately through Microsoft Remote Server Administration Tools (RSAT), using the AD DS and LDS Tools capability. On a Windows client, run PowerShell as administrator and install Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0. SCCM discovery is then configured independently in the Configuration Manager console.
What you are installing
ADUC is an MMC snap-in for managing Active Directory users, computers, groups, organizational units (OUs), and related objects. It is included in RSAT’s Active Directory Domain Services and Lightweight Directory Services Tools component.
As an Amazon Associate I earn from qualifying purchases.
Configuration Manager (formerly SCCM) can query Active Directory, but it does not install ADUC and does not require ADUC for discovery. RSAT installs management tools; it does not grant additional Active Directory permissions.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Microsoft’s RSAT documentation covers supported Windows client and Server releases: Install and Manage Remote Server Administration Tools in Windows.
#1 Best Overall
- 64 bit | 1 Server with 16 or less processor cores | provides unlimited VMs
- For highly virtualized datacenters and cloud environments
- Requires Windows Server 2025 User and/or Device Client Access Licenses (CALs) | No CALs are included
- Core-based licensing | Additional Server Datacenter license packs required for servers with more than 16 processor cores
- Product ships in plain envelope | Activation key is located under scratch-off area on label |Beware of counterfeits | Genuine Windows Server software is branded by Microsoft only.
Do you need ADUC for your SCCM task?
| Task | ADUC required? | SCCM configuration required? |
|---|---|---|
| Browse or modify AD users and computers | Yes, or another AD management tool | No |
| Discover computers from AD | No | Yes |
| Discover users from AD | No | Yes |
| Discover security-group membership | No | Yes |
| Create collections from discovered AD data | No | Yes |
| Verify an object’s OU or group | Useful | No |
| Move a computer to an OU before discovery | Useful | No |
Installing ADUC will not make a device appear in Configuration Manager. Discovery runs from the site server, using its computer account or a configured discovery account.
Prerequisites
- A supported Windows client or Windows Server release and matching architecture.
- Local administrator rights, or an approved elevation method, to add Windows capabilities or server features.
- Access to Windows Update, WSUS, Microsoft’s feature source, or compatible Features on Demand media.
- DNS and network connectivity to the Active Directory domain and domain controllers if you will connect ADUC to a domain.
- Credentials with enough rights for the AD operation you intend to perform. Installing RSAT itself does not provide those rights.
Install ADUC on Windows 10 or Windows 11
PowerShell method
- Open PowerShell as administrator.
- Confirm that the capability is available:
Get-WindowsCapability -Online | Where-Object Name -like 'RSAT.ActiveDirectory.DS-LDS.Tools*' - Install the AD DS/LDS tools:
Add-WindowsCapability -Online ` -Name 'Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0' - Verify the result:
Get-WindowsCapability -Online | Where-Object Name -like 'RSAT.ActiveDirectory.DS-LDS.Tools*'Look for
State : Installed. Successful installation commonly reportsOnline : TrueandRestartNeeded : False. - Launch ADUC with:
dsa.msc
Settings method
- Open Settings > System > Optional features.
- Select View features or Add an optional feature; wording varies by Windows release.
- Search for and select RSAT: Active Directory Domain Services and Lightweight Directory Services Tools.
- Select Next, then Install.
- Open Windows Tools and choose Active Directory Users and Computers.
The PowerShell capability name is more consistent than the Settings labels, which can vary by release, language, and servicing level.
Install ADUC on Windows Server
Server Manager
- Open Server Manager.
- Select Manage > Add Roles and Features.
- Advance to the Features page and expand Remote Server Administration Tools.
- Select the AD DS and AD LDS management tools, complete the wizard, and open the snap-in from Server Manager > Tools or Windows Tools.
PowerShell
Get-WindowsFeature -Name RSAT*
Install-WindowsFeature `
-Name RSAT-AD-Tools `
-IncludeAllSubFeatureInstall-WindowsFeature is the Server method; do not use it as the installation command on a normal Windows client. See Microsoft’s RSAT installation guidance.
Rank #2
- Core-based licensing | Add to Windows Server 2025 Datacenter to license all processor cores.
- No media, no key | Base license with media and key required
- Beware of counterfeits | Genuine Windows Server software is branded by Microsoft only.
Open ADUC and connect to the right domain
- Run
dsa.msc, or open it from Windows Tools. - Right-click Active Directory Users and Computers and select Connect to Domain.
- Enter the domain DNS name, for example
corp.example.com. - Provide alternate credentials if the logged-on account is not suitable.
When investigating replication or site-specific behavior, connect to a specific domain controller where appropriate. These tests help separate an RSAT problem from DNS, domain, or secure-channel problems:
whoami
whoami /user
echo %USERDNSDOMAIN%
nltest /dsgetdc:corp.example.com
nslookup corp.example.com
Test-ComputerSecureChannel -VerboseConfigure Active Directory discovery in SCCM
In the current Configuration Manager console, go to Administration > Hierarchy Configuration > Discovery Methods. Discovery methods are separate; select the one matching the object you need.
Computer discovery: Active Directory System Discovery
- Open Active Directory System Discovery and enable it.
- Add the required domain, OU, or container.
- Choose the site server computer account or a configured discovery account.
- Set the polling schedule and save the configuration.
- After the schedule runs, check the device in Assets and Compliance.
System Discovery creates computer resources used by collections, queries, and client-push scenarios. It does not itself install or validate the Configuration Manager client. Details are in Microsoft’s discovery methods documentation.
Rank #3
- 64 bit | 1 Server with 24 or less processor cores | provides unlimited VMs
- For highly virtualized datacenters and cloud environments
- Requires Windows Server 2025 User and/or Device Client Access Licenses (CALs) | No CALs are included
- Core-based licensing | Additional Server Datacenter license packs required for servers with more than 16 processor cores
- Product ships in plain envelope | Activation key is located under scratch-off area on label |Beware of counterfeits | Genuine Windows Server software is branded by Microsoft only.
User discovery: Active Directory User Discovery
Enable this method when you need user accounts and their attributes for user collections, queries, or user-targeted deployments.
Group discovery: Active Directory Group Discovery
Use Group Discovery for groups, memberships, and nested-group relationships. Limit the scope to required groups or OUs; unrestricted or deeply recursive discovery can increase directory and network load. Group Discovery does not replace System Discovery when you need complete computer resource records.
Forest discovery: Active Directory Forest Discovery
Forest Discovery supplies information about forests, domains, and sites for Configuration Manager planning and boundary-related configuration. It is distinct from System, User, and Group Discovery. Microsoft’s method-selection guidance is at Select discovery methods to use.
Rank #4
- Core-based licensing | Add to Windows Server 2025 Datacenter to license all processor cores.
- No media, no key | Base license with media and key required
- Beware of counterfeits | Genuine Windows Server software is branded by Microsoft only.
Accounts and permissions
Discovery can run under the site server computer account or a configured Windows discovery account. Use a dedicated account when that is easier to audit or when delegated access is required across domains. Grant read access to only the domains, OUs, and groups in scope; Domain Admin rights are not a prerequisite merely because discovery is enabled. Delegated OU security and the exact discovery configuration determine the permissions needed. Microsoft’s account guidance is available at Accounts used in Configuration Manager.
For multiple forests or domains, verify trusts (where required), DNS resolution, routing, and permissions in each directory. An AD object can be present without having a Configuration Manager client installed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Verify that discovery worked
- Confirm the selected domain, OU, container, or group is the intended scope.
- Confirm the method is enabled and its schedule has run.
- Search Assets and Compliance for the expected computer, user, or group resource.
- Check the discovered domain, OU, and attributes against ADUC.
- Review the appropriate site-server log in the Configuration Manager
Logsdirectory:
adsysdis.log— Active Directory System Discoveryadusrdis.log— Active Directory User Discoveryadsgdis.log— Active Directory Group Discovery
Troubleshoot installation and discovery failures
RSAT installation returns 0x800f0954
This commonly indicates that WSUS or Windows Update policy blocks optional-feature content, the device cannot reach its feature source, the source does not match the OS build, or a proxy or firewall is interfering. Check the capability, edition, and build:
Best Value
- Server 2022 Standard 16 Core
Get-WindowsCapability -Online |
Where-Object Name -like 'RSAT*'
Get-WindowsEdition -Online
winverThen review Windows Update or WSUS policy and use Features on Demand media or an internal source that matches the operating-system release and architecture. A random CAB from another build is not a reliable substitute.
The capability remains NotPresent
- Confirm the shell was elevated and the capability name is spelled exactly.
- Check servicing logs and optional-feature source availability.
- Verify that the source is complete and compatible with the installed build.
ADUC opens but cannot connect
- Test domain-controller discovery with
nltest /dsgetdc:corp.example.com. - Test DNS with
nslookup corp.example.com. - Check domain join status, secure-channel health, firewall rules, and network segmentation.
- Use alternate credentials and confirm those credentials can perform the intended AD operation.
ADUC works but SCCM discovers nothing
- Verify that the correct method is enabled: System for computers, User for users, or Group for groups.
- Check the configured domain, OU, container, or group scope.
- Confirm the discovery account has read access and that the schedule has run.
- Review
adsysdis.log,adusrdis.log, oradsgdis.logon the site server.
A group appears, but its computers do not
Group Discovery reports group and membership information; it is not a substitute for full computer discovery. Enable Active Directory System Discovery for the computers’ domain or OUs.
Quick Recap
Alternatives to installing ADUC locally
- SCCM console only: Configure all discovery methods without installing ADUC when you do not need to administer AD objects.
- PowerShell: The same AD DS/LDS RSAT capability provides the Active Directory module, including
Get-ADUser,Get-ADComputer,Get-ADGroup, andGet-ADOrganizationalUnit. - Centralized administration: Use a management server, Windows Admin Center, or server-hosted tools when endpoint software installation or privilege is tightly controlled.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems
