Установить оснастку active directory на windows 10 21h1

Microsoft has released a new version of Windows 10, dubbed version 21H1. This version brings new functionality that many organizations are eager to utilize. In many organizations, Windows-based devices are joined to Active Directory Domain Services (AD DS), so devices can be managed centrally and end-users can sign-in on any domain-joined device of their liking.

A new Windows version means that Active Directory needs to be properly prepared. In this blogpost, I’ll show you how to prepare Active Directory for Windows 10, version 21H1:

Group Policy

Windows 10, version 21H1 comes with ten new Group Policy settings. To centrally manage Group Policy, you can update the Group Policy Central Store with the new Group Policy template (*.admx) and Group Policy language (*.adml) files. This way, you can centrally manage the versioning of Group Policy templates.

Note:
If your organization doesn’t use the Group Policy Central Store feature, yet, now is a good time to implement it.

You can download the Download Administrative Templates (.admx) for Windows 10 May 2021 Update (21H1) from the Microsoft Download Center. This download includes *.adml files for the Czech, Danish, German, Greek, English, Spanish, Finnish, French, Hungarian, Italian, Japanese, Korean, Norwegian, Dutch, Polish, Portuguese, Russian, Swedish, Turkish and Chinese languages.

Copy the new PolicyDefinitions folder over the existing PolicyDefinitions folder in the Active Directory System Volume (SYSVOL) share to update the Group Policy Central Store.

When you’re a fan of Microsoft’s security baselines, you can download and implement the Security baseline (final) for Windows 10, version 21H1.

Windows Activation

Active Directory-based Activation (ADbA) is available since Windows Server 2012 as a replacement for Microsoft’s Key Management Services (KMS).

Note:
If your organization doesn’t use Active Directory-based Activation, yet, now is a good time to implement it.

You can download the product keys for your organization from the Volume Licensing Service Center (VLSC). Enter the product keys to automatically activate Windows 10 when it comes into scope of your Windows activation method.

Remote Server Administration Tools

In previous Windows 10 version, the Remote Server Administration Tools (RSAT) needed to be downloaded manually to allow admins to manage Windows Server features from these devices.  However, since Windows 10, version 1809, the RSAT are included as Features on Demand in Windows 10 itself.

Do not download an RSAT package from this page. Instead, perform the following steps on a device running Windows 10, version 21H1:

• Press the Start button.
• Search for Manage optional features.
  Click the search result with the same name
• Click Add a feature.
  You now see the list of available optional features.
• Select and install the specific RSAT tools you need. All RSAT tools names are prefixed with RSAT: , so this makes for easy filtering.

Any Windows Server administrator must have used the Active Directory Users and Computers (ADUC) Microsoft Management Console on a Domain Controller (DC). Using this console, you can control and manage users, user groups, computers, and the Organizational Units (OUs) in the domain.

The ADUC console is no longer limited to servers anymore. You can install the Active Directory Users and Computers snap-in on a Windows 11 or Windows 10 computer as well, which performs the same functions as the original Server console. This snap-in is part of the Remote Server Administration Tools (RSAT) for Windows operating systems.

We have written separate posts for installing any RSAT tools on Windows 11 and Windows 10. This article focuses on installing specifically the Active Directory Users and computers snap-in on a Windows PC and then using it to manage your domain.

How to Install Active Directory Users and Computers (ADUC) on Windows

All RSAT tools, including the Active Directory Users and Computers snap-in, allow you to manage the different Active Directory components as if you are on the server itself. This way, you do not always have to access the server, neither physically nor remotely, to perform an action.

You can download and install the Active Directory Users and Computers snap-in using the Settings app, from the Command Prompt, and Windows PowerShell.

Note: On Windows 10 v1803 and older, you must download and install all RSAT tools using the MSI files. You can find the MSI files for your version of Windows here.

Install Active Directory Users and Computers from Settings App

The easiest way to install the ADUC snap-in on a Windows PC is from the settings app. It does involve more steps than the other methods shared below, but this is the only method using the Windows GUI.

Use these steps to install the ADUC snap-in from the Settings app:

1. Navigate to the following:

   Settings app >> Apps >> Optional Features

2. Click “View features.”

   

3. Search for “Active Directory,” select “RSAT: Active Directory Domain Services and Lightweight Directory Services Tools,” and click Next.

   

4. Click “Install.”

   

5. Once installed, restart the computer.

The Active Directory Users and Computers snap-in will now be installed. If you prefer installing it using the command line, refer to the sections below. To learn how to use the snap-in, continue reading down.

Install Active Directory Users and Computers from Command Prompt

Below are the simple steps to install Active Directory Users and Computers snap-in using the Command Prompt:

1. Open an elevated Command Prompt instance.

2. Run the following command:

   DISM /Online /Add-Capability /CapabilityName:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

   

The ADUC snap-in should now be installed. Run the following command in Command Prompt to confirm that the Active Directory Users and Computers snap-in has been installed:

DISM.exe /Online /Get-CapabilityInfo /CapabilityName:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

You should see “Installed” in front of Status.

Install Active Directory Users and Computers from PowerShell

Use the following steps to install the Active Directory Users and Computer snap-in using PowerShell:

1. Launch an elevated PowerShell instance.

2. Run the following command to install ADUC:

   Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

   

The ADUC snap-in should now be installed. To confirm its status, run the following command in PowerShell:

Get-WindowsCapability -Online | Where-Object {$_.Name -like "RSAT.ActiveDirectory*"}

You should see “Installed” in front of State.

These are all the methods to install the Active Directory Users and Computers snap-in on a Windows 11/10 PC. Let us now continue to see how to use this tool.

How to Use Active Directory Users and Computers

How to Open Active Directory Users and Computers Snap-In

Now that Active Directory Users and Computers is installed, you can open it by searching for it in the Start menu, or running the following in the Run Command box:

dsa.msc

Alternatively, you can also open the ADUC snap-in through the Control Panel at the following location:

Control Panel >> System and Security >> Windows Tools

If your computer is connected to a domain and you are logged in from an authorized domain account, then the ADUC snap-in will automatically connect to the server. However, if one is not connected, then you must connect to the Domain Controller.

Connect ADUC to Domain Controller

Use these steps to connect to a Domain Controller. You can also use these to change your domain/Domain Controller.

1. From the ADUC console, click “Action,” and then click “Change Domain Controller.”

   

   The Change Directory Server window will now open.

2. Select the “This Domain Controller or AD LDS instance” radio button, then select the Domain Controller from the give list and click Ok.

   

The ADUC will now connect to the Domain Controller and populate the fields.

Now that you are connected to the Domain Controller, you can now begin making changes and managing the different components of the domain.

Manage Users, Computers, Organizational Unit using ADUC

You can now begin adding new users, computers, printers, and Organizational Units to the domain. Simply right-click on the OU that you want to add the new device/user to, expand “New”, and select the element that you want to add.

Once you have selected the element to add, the respective window will open, where you can then configure the component to add.

You can now also use other operators to manage the users, devices, and other elements configured inside the domain directly from your Windows PC.

Additionally, you can also manage what you see inside the snap-in. Click “View” from the top menu and select the things that you want to see. You can then also click “Filter options” to open the advanced viewing options.

The list does not end here. There are a bunch of other management options you can perform directly from the ADUC snap-in on a Windows PC. We suggest that you play around to discover all the options. However, we advise caution and only use the console if you know what you are doing.

What is Active Directory Users and Computers Used For

By now, we have a pretty good understanding of what the ADUC snap-in can be used for. However, there is more to it than meets the eye. The Active Directory Users and Computers RSAT tool can be used to perform the following actions:

• Create and manage user accounts, computers, and Active Directory groups.
• View and edit AD object attributes with ADSI Edit.
• Search for AD objects.
• Change or reset user password in Active Directory.
• Create organizational units and build hierarchical structures for AD objects. You can also delegate administrative permission on these OUs to other domain users.
• Delegate administrative permissions.
• Raise domain functional level, and transfer FSMO roles with PowerShell to another domain controller.

From this, it is understood how useful the ADUC snap-in is for administrators that use Windows client PCs.

Active Directory Users and Computers (ADUC or DSA.msc) is one of the most commonly used tools for managing objects in an Active Directory domain. You can install ADUC on both Windows Server hosts and Windows 10 and 11 computers. The ADUC MMC snap-in is a part of the Microsoft Remote Server Administration Tools (RSAT). In this article, we’ll show how to install and use the Active Directory Users and Computers console on Windows.

How to Install Active Directory and Computers on Windows 10 and 11?

In modern builds of Windows 10 (1809+) and Windows 11, RSAT is installed online as Features on Demand. To install the Active Directory RSAT on Windows 10/11, go to Settings -> Apps -> Optional Features -> Add an optional feature (View features).

Type ‘Active Directory’ in the search bar and select RSAT: Active Directory Domain Services and Lightweight Directory Services Tool.

Click Next-> Install to start the installation.

Then Windows connects to Microsoft servers, downloads and installs the Active Directory Remote Server Administration Tools (including Active Directory graphical consoles, command prompt tools, and Active Directory PowerShell module).

Or, you can install AD administration tools using PowerShell:

Add-WindowsCapability –online –Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

In previous Windows 10 builds, as well as in Windows 8.1, you can install RSAT using an MSU update. You can download RSAT here:

• RSAT for Windows 10 1803/1709 — https://www.microsoft.com/en-us/download/details.aspx?id=45520
• RSAT for Windows 8.1 — https://www.microsoft.com/en-us/download/details.aspx?id=39296

Download the RSAT version that matches the bitness of your operating system. Double-click the file to start installation:

Or install the MSU file from in the command prompt in the quiet mode:

wusa.exe C:\Install\WindowsTH-RSAT_TP5_Update-x64.msu /quiet /norestart

After the RSAT installation is complete, restart your computer.

Then you just have to activate the necessary options. To do it:

1. Right-click Start and select Control Panel;
2. Click Programs and Features;
3. Click Turn Windows features on or off on the left pane.
4. Expand Remote Server Administration Tools-> Role Administration Tools -> AD DS and AD LDS Tools in the features tree;
5. Check AD DS Tools and click OK.

You can install ADUC from the command prompt as well. Run the commands below one by one:

dism /online /enable-feature /featurename:RSATClient-Roles-AD
dism /online /enable-feature /featurename:RSATClient-Roles-AD-DS
dism /online /enable-feature /featurename:RSATClient-Roles-AD-DS-SnapIns

After the administrative tools have been installed, you will see a link to Active Directory Users and Computers snap-in in the Administrative Tools section of the Control Panel.

How to Use Active Directory Users and Computers Console?

To open the ADUC console, click the icon in the Control Panel or run this command:

dsa.msc

All authenticated domain users can use ADUC to view Active Directory objects.

If your computer is joined to an Active Directory domain, then the ADUC connects to a domain controller depending on the current Logon server ($env:LOGONSERVER). The name of the domain controller you are connected to is at the top of the console.

You can connect to another AD domain controller or another domain by clicking the console root and selecting the Change option you want in the context menu.

The Active Directory console shows a tree-like Organizational Unit (OU) structure of your domain (and a separate section containing AD Saved Queries).

A domain administrator may create containers (OUs) based on a physical or logical organization structure. Using a context menu, you can create new AD objects (users, groups, computers, OUs, contacts), rename, move, or delete objects. Depending on the selected object type, context menu options may vary.

For example, a user has options to reset the AD password or enable/disable the account.

You can use the Search context menu to search for objects in AD.

An administrator can delegate permissions to create/edit/delete objects in Active Directory to other users or groups.

Using the View -> Add/Remove columns menu, you can add object attributes you want to see in the ADUC console.

In ADUC, you can view or change domain object properties. For example, you can open user properties and edit its settings. Some user properties are located in the corresponding tabs, and the full list of user attributes is available in the AD Attribute Editor tab.

You can add a separate tab with an AD user photo.

To show system containers and object properties in the Active Directory snap-in (they are hidden by default), check View -> Advanced Features.

Then all AD objects get a number of system tabs. For example, you can get a canonical object name, view an account creation date, or check Protect object from accidental deletion in the Object tab.

ADUC: Connecting Domain from a Workgroup Computer?

If you want to connect to a domain controller from a computer outside your domain (a workgroup computer) using ADUC, follow the instructions below:

1. Open the command prompt and run the mmc console as a different user: runas /netonly /user:woshub\jsmith mmc
2. In the empty MMC console, select File->Add/Remove Snap-In;
3. Move the Active Directory Users and Computers snap-in to the right panel and click Add;
4. To connect to a domain, click the console root and select Change domain. Enter the domain name.

Then the ADUC console connects to the domain controller, gets, and displays the container (OU) structure of the Active Directory domain.