- Configuring Defender Antivirus: Exclusions, real-time protection, scans, and remediations - Mon, Sep 26 2022
- Get updates for Windows Server 2022 in WSUS - Mon, Sep 19 2022
- Microsoft Defender: Control updates for malware signatures using Group Policy or PowerShell - Thu, Sep 15 2022
There have always been numerous additional components for Windows that the operating system setup has not installed, but which you had to add later using the Control Panel. These might include Internet Information Services (IIS), Hyper-V, or a telnet client.
Optional features that are not preinstalled ^
In Windows 10, if you use the Settings app instead of the Control Panel for this task, you will find a list with several modules under Apps & features > Manage optional features. They are already on board, and you can immediately add them (see this overview of optional features).
If the desired feature does not appear here, click on Add a feature. This action will usually start the search for optional features on Windows Update. However, if the client obtains its updates from WSUS, Windows 10 will request the software from the internal update server.
RSAT is not in the optional features of WSUS ^
To make the optional features available in WSUS, the administrator must select Windows 10 Feature on Demand and also ensure updates are enabled under Classifications.
Setting up a view for Feature on Demand in the WSUS console will fill it with countless language packs, even though there is a dedicated product for them in WSUS. In addition, the .NET Framework, DirectX, and various fonts will be available as well.
If you search for the RSAT here, it will be in vain; starting with Windows 10 1809, you must obtain these as optional features via the internet. For unknown reasons, Microsoft does not provide them via WSUS.
Due to this reason, the installation of the RSAT as an optional feature will usually fail if PCs obtain their updates from WSUS.
If you want to install RSAT via the Settings app, the operation will abort after some time without further notice. PowerShell, on the other hand, ends the operation with a useless error message (see also my instructions for installing RSAT).
Allowing access to Windows Update via Group Policy ^
Since Windows 10 cannot obtain the RSAT via WSUS, it must be able to contact Windows Update in addition to the internal update server. You can do this using "Specify settings for optional component installation and component repair" in Group Policy under Computer Configuration > Policies > Administrative Templates > System.
In addition to enabling the policy, select the checkbox Download repair content and optional features directly from Windows Update instead of WSUS. After updating the Group Policy Objects (GPOs) with gpupdate, the installation of RSAT should work.
Checking another setting for troubleshooting ^
Should Windows 10 still not be able to download optional features over the internet, you should check whether the Group Policy "Do not connect to Windows Update Internet addresses" is enabled. Find this under Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update.
It would of course also prevent the download of optional features. Usually you would not have used this option without a good reason. One of them might be that you want to block Store apps from updating themselves by directly connecting to the Microsoft Store and bypassing WSUS.
Installation from ISO ^
If you don't want resolve this problem via group policies, and it's only about installing the RSAT on some admin PCs, you still have the option to install them offline.
To do this, download Part 1 of the ISO images with the optional features from the Volume Licensing Service Center. These ISOs are also available to MSDN subscribers.
For example, to install the DHCP console from there, enter this command:
Subscribe to 4sysops newsletter!
Get-WindowsCapability -Online -Source d:\ | ? Name -like *RSAT.DHCP* | Add-WindowsCapability -Online -Source d:\
You must adjust the value for the parameter Source so it matches the drive on which you have mounted the ISO.