How to force reinstall of Windows Remote Server Administration tools (RSAT)? (error 0x80070005, Access Denied)

I have patiently and faithfully reinstalled Remote Server Administration tools (RSAT) on my Windows 10 (pro) Workstation after each feature update (and Early Release build), but now it's partially broken and I'd like to do a clean reinstall, but:

• if I try to remove the existing RSAT
  • kb2693643 is not visible in control / programs / View Installed Updates
  • c:\> WUSA /uninstall /kb:2693643 finds the update and starts uninstalling, but fails at the end with Access Denied. Same error in Safe Mode with no networking.
• if I try to install RSAT, I get error "this update is already installed on this computer"

This is Windows 10 Pro Ver 1709, RSAT KB2693643.

I'm down this road because e.g, DHCP works, but DNS does not... I could probably cobble something together with files from another machine, but I'd have more confidence in a tool I depend on every day if I could do a normal install.

Can anyone suggest a hack that would make RSAT appear uninstalled so the regular installer would try to work? WUSA does not have an appropriate option.

If you're using Microsoft Windows Server 2019, specifically build 1809 or later, then you need to install RSAT through Features On Demand. Some people report enabling WSUS helps, too, although it's not 100% clear why (it might depend on whether your organization uses SCCM vs. Windows Update repository for updates).

1. Go to Server Manager.
2. In the top right Manage button, select Add Roles or Features...
3. Click Next until you get to the Add Features train in the wizard
4. Select Remote Server Administration Tools, or the sub-set of features you need.

Note that scripts I found on TechNet Gallery, as well as guides published by Packt Publishing's Windows Server 2019 Automation with PowerShell Cookbook 3rd Ed, do not seem to actually work if you use SCCM like we do. Notably, Get-WindowsCapability -Online only returns the set of capabilities your SCCM server allows clients to see, so these tools erroneously say that RSAT is installed, rather than verifying they're installed.