How to Audit and Install Optional Features in Windows 11 Using PowerShell Get-WindowsCapability

Windows 11 includes numerous optional packages known as Features on Demand (FOD), which are standalone operating system components that are not preinstalled by default to conserve disk footprint and system resources. Examples include the OpenSSH server, Remote Server Administration Tools (RSAT), the Graphics Tools DirectX diagnostics suite, Windows Media Player legacy binaries, and legacy XPS viewers. While users can toggle these modules through the Settings application, system administrators and power users can manage, query, install, and deprovision optional components programmatically across local or remote systems using the PowerShell Get-WindowsCapability cmdlet.

Understanding Features on Demand and Get-WindowsCapability

The Get-WindowsCapability cmdlet is part of the integrated DISM (Deployment Image Servicing and Management) module in PowerShell. It queries the servicing stack of the active operating system image to enumerate all registered Windows capabilities along with their respective deployment states.

Each feature reported by the cmdlet exhibits one of two primary installation states:

• Installed: The binary files, dependencies, and system manifests are deployed and active within the local Windows component store (WinSxS).
• NotPresent: The capability is registered in the system index, but the payload files reside on Windows Update or a designated network staging repository rather than consuming local drive space.

Auditing Available and Installed Capabilities

To inspect the status of optional components, launch Windows Terminal or PowerShell with administrative privileges (right-click the Start menu and select Terminal (Admin)). Run the following baseline command to retrieve the status of all available capabilities on the active system:

Get-WindowsCapability -Online

The -Online parameter targets the running operating system instance rather than an offline Windows image (.wim) file. Because this command returns hundreds of entries, refine the output using PowerShell filtering pipelines.

To audit only those optional features that are currently installed and occupying disk space, run:

Get-WindowsCapability -Online | Where-Object { $_.State -eq "Installed" } | Format-Table Name, State

Conversely, to search for a specific component suite, such as Remote Server Administration Tools (RSAT) or OpenSSH, apply a wildcard string filter to the Name attribute:

Get-WindowsCapability -Online | Where-Object { $_.Name -like "*OpenSSH*" }

Installing Optional Features Using Add-WindowsCapability

Once you identify the exact system name of the desired capability, use the complementary Add-WindowsCapability cmdlet to download and provision the payload. For instance, to deploy the OpenSSH Client and OpenSSH Server capabilities, execute:

Add-WindowsCapability -Online -Name "OpenSSH.Server~~~~0.0.1.0"

PowerShell contacts the configured Windows Update endpoint, downloads the package archive, registers the service binaries, and writes the required registry keys. A progress bar indicates download status. When complete, the cmdlet returns an object showing RestartNeeded: False or True depending on whether a reboot is required to activate the servicing payload.

To deploy entire toolsets simultaneously, pipe the query output directly into the installer. For example, to install all available RSAT Active Directory and DNS management tools in a single automated step, run:

Get-WindowsCapability -Online | Where-Object { $_.Name -like "*Rsat.ActiveDirectory*" -and $_.State -eq "NotPresent" } | Add-WindowsCapability -Online

Removing Deprecated or Unused Features

Removing unnecessary capabilities hardens endpoint security by eliminating unneeded attack surfaces and reclaims disk space in enterprise deployments. To deprovision an installed capability, pipe the package name to the Remove-WindowsCapability cmdlet:

Remove-WindowsCapability -Online -Name "App.Support.QuickAssist~~~~0.0.1.0"

Upon execution, the component store unregisters the application, reverting its state from Installed to NotPresent without corrupting operating system dependencies.