How to Set Up Active Directory Domain Services on Windows Server 2022

How to Add and Remove Windows Server Roles and Features with PowerShell on Windows Server 2022

Windows Server 2022 uses a modular architecture where capabilities are added or removed as Roles and Features. Roles are major server functions like Active Directory Domain Services, IIS, or DHCP Server. Features are supporting components like .NET Framework, Failover Clustering, or Windows PowerShell tools. Managing these through PowerShell gives you repeatability, scriptability, and the ability to configure Server Core installations that have no GUI. This guide covers every aspect of role and feature management using the ServerManager module.

Understanding Roles vs. Features

A Role is a primary server function that defines the server’s purpose on the network. Examples include Web Server (IIS), DNS Server, DHCP Server, Active Directory Domain Services (AD DS), File and Storage Services, and Remote Desktop Services. A Role Service is a sub-component of a role — for example, the Web Server role has role services like ASP.NET 4.8, Windows Authentication, and URL Authorization.

A Feature supports or extends roles — examples include .NET Framework 4.8, Windows Server Backup, BitLocker Drive Encryption, and Failover Clustering. Many roles require specific features to be present and will automatically install them as dependencies when you install the role.

Importing the ServerManager Module

The ServerManager module is included with Windows Server 2022 Desktop Experience and Server Core. It provides the cmdlets for managing roles and features. On Server Core, this module is how you do everything since there is no GUI.

# Import the module explicitly
Import-Module ServerManager

# Verify it loaded
Get-Module ServerManager

# Check what commands are available in this module
Get-Command -Module ServerManager

The module is typically auto-imported in PowerShell 3.0 and later when you call one of its cmdlets, but explicitly importing it is a good practice in scripts to ensure it is available before the first cmdlet call.

Listing Available Roles and Features

Get-WindowsFeature returns all roles, role services, and features available on the server, along with their installation state. The Installed property indicates whether a component is currently installed.

# List all available features (installed and available)
Get-WindowsFeature

# Show only installed features
Get-WindowsFeature | Where-Object { $_.InstallState -eq "Installed" }

# Show only available (not installed) features
Get-WindowsFeature | Where-Object { $_.InstallState -eq "Available" }

# Search by name pattern
Get-WindowsFeature | Where-Object { $_.Name -like "*IIS*" }
Get-WindowsFeature | Where-Object { $_.DisplayName -like "*Active Directory*" }

# Show a specific feature and its sub-features
Get-WindowsFeature -Name Web-Server
Get-WindowsFeature -Name Web-Server | Select-Object -ExpandProperty SubFeatures

The output columns are: Display Name (human-readable), Name (the identifier used in Install/Remove commands), and Install State (Installed, Available, or Removed).

Installing a Single Role or Feature

Install-WindowsFeature is the primary cmdlet for adding roles, role services, and features. By default it installs only the feature you specify. Use the -IncludeAllSubFeature and -IncludeManagementTools flags when you want a complete installation.

# Install the Web Server (IIS) role with all sub-features and management tools
Install-WindowsFeature -Name Web-Server -IncludeAllSubFeature -IncludeManagementTools

# Install DNS Server role with management tools
Install-WindowsFeature -Name DNS -IncludeManagementTools

# Install DHCP Server
Install-WindowsFeature -Name DHCP -IncludeManagementTools

# Install Active Directory Domain Services
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# Install .NET Framework 4.8 features
Install-WindowsFeature -Name NET-Framework-45-Features -IncludeAllSubFeature

# Install File Server role
Install-WindowsFeature -Name FS-FileServer

The output of Install-WindowsFeature returns a result object with properties: Success (True/False), RestartNeeded (Yes/No/Maybe), FeatureResult (list of installed features), and ExitCode.

# Capture the result and check if a restart is needed
$result = Install-WindowsFeature -Name Web-Server -IncludeAllSubFeature -IncludeManagementTools
$result.Success
$result.RestartNeeded
$result.FeatureResult

Installing Multiple Features at Once

You can pass a comma-separated list or an array of feature names to install several features in a single call, which is much faster than installing them individually because Windows processes the dependency tree once.

# Install multiple features in a single call
Install-WindowsFeature -Name Web-Server, DNS, DHCP -IncludeManagementTools

# Using an array variable
$Features = @(
    "Web-Server",
    "Web-Asp-Net45",
    "Web-Net-Ext45",
    "Web-ISAPI-Ext",
    "Web-ISAPI-Filter",
    "Web-Mgmt-Console",
    "NET-Framework-45-ASPNET"
)
Install-WindowsFeature -Name $Features -IncludeManagementTools

Feature Dependencies

Some features depend on others and will automatically install their prerequisites. PowerShell handles this transparently — when you install a role that has dependencies, all required dependencies are installed automatically. You can inspect what will be installed before committing by using the -WhatIf parameter.

# Preview what would be installed without actually installing
Install-WindowsFeature -Name AD-Domain-Services -WhatIf

# Preview with full sub-features
Install-WindowsFeature -Name Remote-Desktop-Services -IncludeAllSubFeature -WhatIf

The -WhatIf output will list every feature and sub-feature that would be installed, including auto-resolved dependencies. Use this before running large installations to avoid surprises.

Installing from a WIM Source (SxS Folder)

On servers that have been patched or do not have internet access to Windows Update, some features cannot be installed because the source files are missing from the local system. This commonly affects features like .NET Framework 3.5 that are not included in the base install. In this case, you need to provide the path to the SourcesSxS folder from the Windows Server 2022 installation media.

# Mount the ISO first (if working with an ISO file)
Mount-DiskImage -ImagePath "D:ISOWindowsServer2022.iso"
$DriveLetter = (Get-Volume | Where-Object { $_.FileSystemLabel -like "*Server*" }).DriveLetter

# Install .NET Framework 3.5 from SxS source
Install-WindowsFeature -Name NET-Framework-Core `
    -Source "${DriveLetter}:SourcesSxS" `
    -IncludeAllSubFeature

# If using a network share path for the SxS folder
Install-WindowsFeature -Name NET-Framework-Core `
    -Source "\fileservershareWS2022SourcesSxS"

# If the feature was previously removed and you need to re-add it
DISM /Online /Enable-Feature /FeatureName:NetFx3 /All /LimitAccess /Source:"E:SourcesSxS"

The -Source parameter accepts local paths, UNC paths, and drive letter paths pointing to the SxS directory. This is essential for air-gapped environments or when Windows Update is unavailable.

Server Core vs. Desktop Experience Features

Windows Server 2022 can be installed as Server Core (no GUI) or Desktop Experience (full GUI). Server Core has a smaller attack surface and lower resource usage, but many GUI-based management tools are not available. PowerShell is the primary management interface for Server Core.

# Check if running Server Core or Desktop Experience
$isCore = (Get-WindowsFeature -Name Server-Gui-Shell).InstallState -ne "Installed"
If ($isCore) { Write-Host "Server Core" } Else { Write-Host "Desktop Experience" }

# The Server-Gui-Mgmt-Infra and Server-Gui-Shell features represent the GUI
Get-WindowsFeature -Name Server-Gui-Shell, Server-Gui-Mgmt-Infra

# Convert Desktop Experience to Server Core (removes GUI — irreversible without reinstall in most cases)
# WARNING: This removes the graphical shell
Uninstall-WindowsFeature -Name Server-Gui-Shell, Server-Gui-Mgmt-Infra -Restart

# Install GUI back (if you have installation media available)
Install-WindowsFeature -Name Server-Gui-Shell, Server-Gui-Mgmt-Infra -Restart

On Server Core, you can still install all server roles. The management tools (GUI snap-ins and MMC consoles) simply will not be installed on the Server Core machine itself — you manage it remotely using RSAT (Remote Server Administration Tools) from a Desktop Experience server or a Windows 10/11 admin workstation.

Installing RSAT Tools

RSAT tools allow you to manage a remote server’s roles from another machine. When you add -IncludeManagementTools to an Install-WindowsFeature call, it installs the RSAT tools for that role on the current machine.

# Install RSAT tools for Active Directory on a management machine
Install-WindowsFeature -Name RSAT-ADDS, RSAT-ADDS-Tools, RSAT-AD-AdminCenter

# Install RSAT for DNS management
Install-WindowsFeature -Name RSAT-DNS-Server

# Install RSAT for DHCP management
Install-WindowsFeature -Name RSAT-DHCP

# Install all RSAT tools at once
Get-WindowsFeature | Where-Object { $_.Name -like "RSAT*" } |
    Install-WindowsFeature

Removing Roles and Features

Remove-WindowsFeature (also aliased as Uninstall-WindowsFeature) removes installed roles and features. Removing a role does not automatically remove its data (for example, removing DHCP leaves the DHCP database intact). Always verify that no dependent services are running before removing a role in production.

# Remove the IIS Web Server role
Remove-WindowsFeature -Name Web-Server -IncludeManagementTools

# Remove DNS Server (same as Uninstall-WindowsFeature)
Uninstall-WindowsFeature -Name DNS -IncludeManagementTools

# Remove multiple features at once
Remove-WindowsFeature -Name DHCP, Fax -IncludeManagementTools

# Preview removal before executing
Remove-WindowsFeature -Name Web-Server -WhatIf

# Remove a feature and restart if needed
$result = Remove-WindowsFeature -Name Web-Server -IncludeManagementTools
If ($result.RestartNeeded -eq "Yes") {
    Restart-Computer -Force
}

Verifying Installation

After installing a role or feature, always verify that the installation succeeded and that the associated services are running.

# Check if IIS is installed
(Get-WindowsFeature -Name Web-Server).InstallState

# Check IIS service status after install
Get-Service -Name W3SVC

# Check all services associated with a role
Get-WindowsFeature -Name Web-Server | Select-Object -ExpandProperty SubFeatures |
    ForEach-Object { Get-WindowsFeature -Name $_ } |
    Where-Object { $_.InstallState -eq "Installed" }

# Use Get-WindowsFeature to verify exact install state
$feature = Get-WindowsFeature -Name DHCP
$feature.InstallState  # Should be "Installed"
$feature.Installed     # Should be $true

Restart Requirements

Many role installations require a restart to complete. You can handle restarts within your script or defer them. The -Restart parameter causes an immediate restart after installation completes. Without it, the installation finishes but changes are not fully active until after a manual restart.

# Install with automatic restart
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools -Restart

# Install without restart, then check if restart is needed
$result = Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
If ($result.RestartNeeded -eq "Yes") {
    Write-Host "Restart required. Scheduling restart in 5 minutes."
    shutdown.exe /r /t 300 /c "Restarting to complete feature installation"
}

# Check if a pending restart exists (from any source)
$pendingReboot = Test-Path "HKLM:SOFTWAREMicrosoftWindowsCurrentVersionComponent Based ServicingRebootPending"
Write-Host "Pending reboot: $pendingReboot"

Scripting a Complete Server Role Deployment

For automated server builds, combine all the above into a deployment script. Here is an example for deploying a full IIS web server:

#Requires -RunAsAdministrator
Import-Module ServerManager

$WebFeatures = @(
    "Web-Server",
    "Web-Common-Http",
    "Web-Default-Doc",
    "Web-Dir-Browsing",
    "Web-Http-Errors",
    "Web-Static-Content",
    "Web-Http-Redirect",
    "Web-Health",
    "Web-Http-Logging",
    "Web-Performance",
    "Web-Stat-Compression",
    "Web-Dyn-Compression",
    "Web-Security",
    "Web-Filtering",
    "Web-App-Dev",
    "Web-Net-Ext45",
    "Web-Asp-Net45",
    "Web-ISAPI-Ext",
    "Web-ISAPI-Filter",
    "Web-Mgmt-Tools",
    "Web-Mgmt-Console",
    "NET-Framework-45-ASPNET"
)

Write-Host "Installing IIS and components..."
$result = Install-WindowsFeature -Name $WebFeatures -IncludeManagementTools

If ($result.Success) {
    Write-Host "Installation successful."
    Get-WindowsFeature | Where-Object { $_.Name -in $WebFeatures } |
        Select-Object DisplayName, InstallState
} Else {
    Write-Error "Installation failed."
    $result
}

If ($result.RestartNeeded -eq "Yes") {
    Write-Host "A restart is required."
}

Managing roles and features entirely through PowerShell gives you the ability to build identical servers consistently, document your server configuration as code, and manage Server Core deployments effectively. Every role deployment should be scripted, tested in a staging environment, and version-controlled before being applied to production systems.