This document is for:

Deployment: Invicti Platform on-demand

Install internal agent on Windows

Invicti Platform allows you to use internal agents to scan targets within your internal environment that aren't publicly accessible from the internet. This is also useful when you prefer not to trustlist Invicti cloud agents.

This document explains how to install the Invicti internal agent in a Windows environment. For other installation methods, refer to:

• Install an internal agent using Docker
• Install an internal agent with proxy settings
• Install an autoscaling agent using Kubernetes

Limitations for internal agents

When the site is internal and you prefer using internal agents for the scan, you can create and import Login Sequence Records (LSRs) through the Windows agent. However, Business Logic Records can only be imported - you can't record them through an internal agent. For more information, refer to the Standalone login sequence recorder overview.

LSR polling on Windows agents

When creating an LSR through a Windows internal agent, the LSR window can take up to about 30 seconds to open. The agent picks up the recording job on its next polling cycle. The default polling interval is 30 seconds, configured by poll_frequency in the agent's agent.yaml file, located in the agent installation directory (for example, C:\InvictiAgent). To reduce the wait, lower the value — for example, poll_frequency: 10s — then restart the internal agent service for the change to take effect.

Prerequisites

System requirements

To run scans successfully, the agent requires sufficient system resources. The agent only initiates a new scan if the following minimum resources are available:

• CPU: 2 free cores on a 64-bit processor
• Memory (RAM): 6 GB available
• Disk space: 50 GB free
• Supported systems: Microsoft Windows 10 or Windows Server 2019 or later, installed directly on the host operating system. The Desktop Experience installation option is required. Windows Server Core is not supported.

Unsupported environments

The Windows internal agent is supported only when installed directly on a Windows host operating system with the Desktop Experience installation option.

The following are not supported and will fail:

• Windows Server Core. Server Core omits the Win32 desktop subsystem, including the windowing and GDI components (user32.dll, gdi32.dll) that the browser requires.
• Windows containers, including any image based on mcr.microsoft.com/windows/servercore. Invicti does not publish or test a Windows container image for the internal agent.
• Nano Server and any other minimal or headless Windows installation variant.

Why the desktop experience is required: the agent uses Chromium to render and interact with target applications during scanning and during Login Sequence Recorder (LSR) sessions. Chromium on Windows registers a window class and starts a Win32 message loop when the browser process launches, and it does this even in headless mode. When the desktop subsystem is absent, the browser process fails to start or exits immediately, and scans or LSR sessions fail with no page ever loading.

If you need a containerized agent, use the supported Linux container image instead. Refer to Install an internal agent using Docker.

Access requirements

• Administrator privileges for command execution
• Invicti Platform Administrator role

Trustlisting requirements

• Trustlist requirements for the CA region
• Trustlist requirements for the EU region
• Trustlist requirements for the US region
• Consequences of scanning without trustlisting

Resource allocation behavior

When the agent starts, it checks the available CPU, RAM, and disk space and calculates how many scans it can run in parallel, running the lowest number those resources allow. You can adjust the per-slot thresholds or set a fixed limit. For the calculation details and override options (agent.yaml thresholds, jobs_override, and the --max-jobs flag), refer to Concurrent scans and resource allocation in the internal scanning introduction.

Steps to install an agent on Windows

1. Select Scans > Agents from the left-side menu.
2. Click Add new agent.

3. Enter a name for the agent and click the Windows tile. The token that's displayed here is then used in the installation command. The agent name must not contain any whitespace characters or special characters.

4. By following the on-screen instructions you're going to:
   • Create a folder where you are going to save the agent
   • Download the agent
   • Run two commands - one with and one without administrative privileges

Installation path restrictions

To avoid permission-related errors, don't install the agent within your User directory (for example, Downloads, Desktop, or Documents). Instead, install it directly to a folder in the system root, such as C:\InvictiAgent.

The installation path must not contain any whitespace characters or special characters. Using a simple directory name consisting only of standard alphanumeric characters is recommended to ensure proper installation and execution.

5. Click Done.

6. Your agent is now installed. You can view it in Invicti by going to the Scans > Agents page.

You can now assign targets to the installed agent and start scanning your targets.

Troubleshooting

To troubleshoot any issues, review the logs located in the logs folder within the agent installation directory you created.

If you encounter an error when starting the agent, try adding Local Service permission inside the agent folder. To do this, right-click your agent folder and select Properties > Security > Edit > Add. Then type Local Service in the text field and click OK > Apply. Once completed, navigate to Services to start the agent service.

For further assistance, contact our Support team.

The agent installs but scans and LSR sessions never start

If the agent registers in Scans > Agents and appears healthy, but scans fail immediately or LSR sessions never open a browser window, confirm the host is not running Server Core.

Run the following in an elevated PowerShell session on the machine where the agent is installed:

(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallationType

Returned value	Meaning	Supported
Server	Windows Server with Desktop Experience	Yes
Client	Windows 10 or later desktop edition	Yes
Server Core	Server Core installation	No
Nano Server	Nano Server installation	No

You can also check directly for the required desktop libraries:

Test-Path "$env:SystemRoot\System32\user32.dll"
Test-Path "$env:SystemRoot\System32\gdi32.dll"

If either returns False, the host can't run the browser and the agent won't be able to complete a scan. Move the agent to a Windows host with the Desktop Experience installation option, or use the Linux Docker agent.

Agent logs are in the logs folder inside the agent installation directory. A browser process that fails to launch is recorded there and is the fastest confirmation of this condition.

Uninstall the service

If you need to uninstall the service, run the following command as a user with administrative privileges:

.\invicti-agent.exe service -u --log-level=info --log-file

---

Need help?

Invicti Support team is ready to provide you with technical help. Go to Help Center