Skip to main content
this document is for:

Deployment: Invicti Platform on-premises

Prerequisites

Part of Windows on-premises installation series

This is part 1 of 4 in the Windows on-premises installation series.
Next: Installation

This document covers the system, software, and configuration requirements for installing Invicti Platform on-premises using the Windows installer. Complete all steps in this document before running the installer.

Invicti Platform on Windows supports Windows 11 and Windows Server 2022 or later.

Why this matters​

Invicti Platform on Windows uses WSL2 to run a lightweight Kubernetes cluster (k3s) inside a custom Linux distribution. The prerequisites ensure your Windows environment can support this architecture - without them, the installer will either fail silently or produce errors that are difficult to diagnose.

Additional requirements

For AWS EC2 deployments, see the AWS EC2 prerequisites section for additional requirements.

System requirements​

RequirementMinimum
Operating systemWindows 11, or Windows Server 2022 or later
WSL version2.4.x or later (2.6.x recommended)
CPU6 cores
RAM16 GB dedicated to the WSL2 VM**
Disk space100 GB free on the installation drive*
Service accountLocal Administrator access; Logon as a Service right
Service account and permissions

The installer creates a local invicti service account automatically and grants it the required permissions. Alternatively, you can provide an existing account during installation — it must have Local Administrator access and the Logon as a Service right.

IPCC (Invicti Platform Control Center) is accessible only to accounts with local administrator access. Domain administrator accounts without local administrator rights are not sufficient.

About disk space and RAM requirements

*The 100 GB requirement is free space on the installation drive, not total disk size. The installer creates a 505 GB dynamic VHDX file that grows as needed - it does not immediately consume the full allocated space. Initial installation consumes approximately 50 to 60 GB (plus the 3 GB installer file). Allocate additional storage based on your expected scan volume - disk usage grows during active scans and shrinks once they complete.

**The 16 GB RAM requirement applies to the WSL2 VM allocation, not total host RAM. The host machine must have enough additional RAM to run Windows alongside the WSL2 VM — plan for at least 20 GB total system RAM. For optimal performance, and especially if you plan to use in-place updates, 32 GB host RAM (with 24 GB allocated to WSL2) is recommended.

Resource planning

These are minimum requirements for running the platform's core services with 1–2 concurrent scans. In production environments, allocate additional resources based on your expected workload:

  • Each concurrent scan requires approximately 6 GB of RAM.
  • The minimum configuration supports 1–2 concurrent scans. For higher scan volumes, increase RAM and CPU allocations proportionally.
  • Temporary disk usage grows during active scans and shrinks once they complete.

Required ports​

The following ports must be free on the host machine before installation. The installer doesn't support changing these port assignments.

PortUsed byDescription
443Invicti Platform applicationHTTPS access to the platform web interface
8088Invicti Platform Control Center (IPCC)Control Center for managing the installation

Ensure no other service is listening on ports 443 or 8088 before running the installer. To verify:

netstat -ano | findstr ":443 "
netstat -ano | findstr ":8088 "

If a port is in use, identify and stop the conflicting service before proceeding.

Required Windows features​

Setup differs between Windows 11 and Windows Server. Follow the section that matches your OS.

On Windows 11, run the following commands in PowerShell as Administrator.

Step 1: Enable required Windows features

Enable Hyper-V and related features needed by the installer:

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-Management-PowerShell -All
Enable-WindowsOptionalFeature -Online -FeatureName VirtualMachinePlatform -All
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux -All

A reboot may be required after enabling these features.

Step 2: Install WSL2

After reboot, run:

wsl --install

This installs WSL2 and enables any remaining required features. A further reboot may be required.

Verify WSL is working:

wsl --status

WSL2 configuration​

  1. Verify your WSL version:

    wsl --version

  2. If your WSL version is below 2.4.x, upgrade it:

    wsl --update

  3. Set WSL2 as the default version:

    wsl --set-default-version 2
WSL2 resource allocation

The installer configures WSL2 memory and swap automatically through the installation wizard. No manual .wslconfig setup is required.

Required services (Windows Server only)​

Expand for Windows Server 2022 or later service requirements

Ensure the following Windows services are running on Windows Server 2022 or later:

Start-Service vds
Set-Service vds -StartupType Automatic
Start-Service vmms
Set-Service vmms -StartupType Automatic

Verify both services are running:

Get-Service vds, vmms | Select Name, Status

Both should show Running.

  • VDS (Virtual Disk Service) - required for VHDX creation and attachment. If stopped, the installer fails silently at the VHDX step with exit code -1.
  • vmms (Virtual Machine Management Service) - core Hyper-V service required for WSL2 to run distros as lightweight VMs.

AWS EC2 prerequisites​

Expand for AWS EC2-specific requirements

When deploying on AWS EC2, the following additional requirements apply.

Configure WSL networking for EC2​

If installing on an AWS EC2 instance, explicitly configure WSL networking (NAT mode) before running the installer. This helps ensure WSL networking starts correctly in the EC2 environment:

@"
networkingMode=NAT
"@ | Add-Content "C:\Users\invicti\.wslconfig"
Important - don't overwrite existing configuration

Use Add-Content to append to the .wslconfig file, not Set-Content. Do not include [wsl2] again — if a [wsl2] section already exists in the file, append the networkingMode line to it rather than adding a duplicate section.

If you configured the installer to use a custom service account, replace C:\Users\invicti with that account's profile directory.

WSL networking on EC2

NAT is the default WSL2 networking mode. This explicit configuration helps in new cloud environments where WSL networking might not initialize correctly without it.

Supported instance types​

Use instance types that support nested virtualization:

  • M8i (general purpose) - for example, m8i.2xlarge
  • C8i (compute optimized)
  • R8i (memory optimized)
Instance types without Hyper-V support

Instance types such as t3 and m5 don't support Hyper-V and WSL2. Don't use these instance types for Invicti Platform on-premises deployments.

Enable nested virtualization using one of the following options:

aws ec2 run-instances \
  --image-id <AMI_ID> \
  --instance-type m8i.2xlarge \
  --cpu-options "NestedVirtualization=enabled" \
  --key-name <KEY_NAME> \
  --security-group-ids <SG_ID> \
  --subnet-id <SUBNET_ID>

EC2 metadata access​

If you're using IMDSv2 (the default on newer instances), verify instance metadata access:

$token = Invoke-RestMethod -Uri http://169.254.169.254/latest/api/token -Method PUT -Headers @{"X-aws-ec2-metadata-token-ttl-seconds"="21600"}
Invoke-RestMethod -Uri http://169.254.169.254/latest/meta-data/instance-type -Headers @{"X-aws-ec2-metadata-token"=$token}

Next steps​

With prerequisites complete, you're ready to proceed with the installation:

→ Continue to Installation

Complete Windows installation series​

Need help?​

Invicti Support team is ready to provide you with technical help. Go to Help Center

Last updated on
Was this page useful?