I kept ending up switching primary work computers, changing domains with different policies, WU servers, etc and it seems that installing RSAT ended up using different method to install on occasion. Here’s what I ended up using that just plain works (so long as you have admin rights).
$currentWU = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "UseWUServer" | select -ExpandProperty UseWUServer
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "UseWUServer" -Value 0
Restart-Service wuauserv
Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability –Online
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "UseWUServer" -Value $currentWU
Restart-Service wuauserv
After it completes, check for what’s installed.
Get-WindowsCapability -Name RSAT* -Online | Select-Object -Property Name, State
Name State ---- ----- Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 Installed Rsat.BitLocker.Recovery.Tools~~~~0.0.1.0 Installed Rsat.CertificateServices.Tools~~~~0.0.1.0 Installed Rsat.DHCP.Tools~~~~0.0.1.0 Installed Rsat.Dns.Tools~~~~0.0.1.0 Installed Rsat.FailoverCluster.Management.Tools~~~~0.0.1.0 Installed Rsat.FileServices.Tools~~~~0.0.1.0 Installed Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0 Installed Rsat.IPAM.Client.Tools~~~~0.0.1.0 Installed Rsat.LLDP.Tools~~~~0.0.1.0 Installed Rsat.NetworkController.Tools~~~~0.0.1.0 Installed Rsat.NetworkLoadBalancing.Tools~~~~0.0.1.0 Installed Rsat.RemoteAccess.Management.Tools~~~~0.0.1.0 Installed Rsat.RemoteDesktop.Services.Tools~~~~0.0.1.0 Installed Rsat.ServerManager.Tools~~~~0.0.1.0 Installed Rsat.Shielded.VM.Tools~~~~0.0.1.0 Installed Rsat.StorageMigrationService.Management.Tools~~~~0.0.1.0 Installed Rsat.StorageReplica.Tools~~~~0.0.1.0 Installed Rsat.SystemInsights.Management.Tools~~~~0.0.1.0 Installed Rsat.VolumeActivation.Tools~~~~0.0.1.0 Installed Rsat.WSUS.Tools~~~~0.0.1.0 Installed