Windows Capability Manager is a bit different than the Windows Package Manager. The Package Manager manages installed app/software/packages. Like so:

get-windowspackage -online |?{$_.packagename -like "*foo*"}

dism /online /get-packages

See the article on Windows Package Manager.

Windows already has builtin capabilities but only some are turned on by default.

The other capabilites need to be enabled only on an as-needed basis.

To get the capabilities:

get-windowscapability -online

get-windowscapability -online |?{$_.name -like "*rsat*"}

get-windowscapability -Name RSAT* -online |select DisplayName,State

To add the capabilities:

add-windowscapability -online -name Microsoft.Windows.Noptepad~~~~0.0.1.0

add-windowscapability -online -name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0"

get-windowscapability -online -name RSAT.active* |add-windowscapability -online
get-windowscapability -online -name RSAT.dns* |add-windowscapability -online
get-windowscapability -online -name RSAT.group* |add-windowscapability -online

To remove the capability:

remove-windowscapability -online -name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

Note that if you get a message about "Permanent Package Cannot be Unistalled"; that usually indicates that you are trying to uninstall a capability that another capability is depending on. In other words, remove the other capability first, then you can remove the dependency.

To get optional features:

dism /online /get-features /format:table

get-windowsoptionalfeature

Administrator Privledges | Locked Down Environment

If you happen to be in a locked down environment where you do not have admin privledes on your system, it's fine as we can work around that.

Copy the following file from a system that has the RSAT tools installed to the locked down system:
C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ActiveDirectory.Management\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.ActiveDirectory.Management.dll

Then on the locked-down system, import the module:
Import-Module .\Microsoft.ActiveDirectory.Management.dll

NOTES:
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges