Hyper-V (Windows 11): AI assistant (LLM)

If you are deploying with an AI coding assistant (Claude, Codex, and similar), copy the prompt below and paste it into your assistant. It drives the same Import-RTA.ps1 flow as the CLI (PowerShell) guide, but written for the assistant to follow step by step, pausing for your confirmation and for the values only you can supply.

Before you paste

Give the assistant a session where it can run PowerShell as Administrator on the Windows 11 host, with the Hyper-V feature enabled (an agentic tool with shell access, or paste the commands it returns into your own elevated PowerShell). Have ready: the path to the extracted RTA package (Import-RTA.ps1 and its Sophos-RTA folder), the name of a wired external virtual switch (or the wired NIC to build one on), and a VM name. The assistant will ask for anything it is missing.

Deployment prompt

You are helping me deploy the Sophos Remote Testing Appliance (RTA) as a Hyper-V
virtual machine on my Windows 11 host, using the bundled Import-RTA.ps1 script.
Work through the steps below in order. You must run PowerShell as Administrator.
Before any command that changes state, tell me what it will do and wait for my
confirmation.

CONTEXT:
- The appliance ships as sophos-rta-hyperv.zip: a pre-built, exported Hyper-V VM plus an
  Import-RTA.ps1 installer. The exported VM is already a Generation 2 VM with
  Secure Boot OFF, 4 vCPU / 8 GB, and MAC address spoofing On. It is a generic
  image with no engagement identity baked in, so on first boot it shows an
  "Appliance Registration" screen with a one-time activation code that I send back
  to Sophos. There is no software to install and no inbound access.

WHAT I WILL PROVIDE (ask me for any you do not have; never guess these):
- <PACKAGE_PATH>: the folder where I extracted sophos-rta-hyperv.zip (for example
  C:\RTA). It contains Import-RTA.ps1 and a Sophos-RTA folder. Use a plain ASCII
  path with no spaces.
- <SWITCH_NAME>: the name of an existing external virtual switch on a WIRED
  Ethernet NIC. If I do not have one, the script can create one; tell me it will.
- <VM_NAME>: the name for the imported VM (the package default is Sophos-RTA).

STEPS:
1. Confirm this PowerShell session is elevated (Administrator) and Hyper-V is
   enabled:
   (New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
   (Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All).State
   Expect True and Enabled. If either is not, stop and tell me: re-open PowerShell
   as Administrator, or enable the Hyper-V feature first.

2. The VM must attach to a WIRED external switch. Wi-Fi-backed switches break the
   appliance: Hyper-V cannot bridge a Wi-Fi adapter as a true Layer-2 peer, so the
   RTA loses L2 adjacency (ARP poisoning, MITM, host discovery fail) and the
   engagement quality degrades. Using Wi-Fi is strongly discouraged. If I gave you
   <SWITCH_NAME>, confirm it is External and bound to a wired NIC:
   Get-VMSwitch -Name "<SWITCH_NAME>" | Select-Object Name,SwitchType,NetAdapterInterfaceDescription
   Expect SwitchType External on a wired (not wireless) adapter. If it is missing,
   Internal/Private, or on a wireless adapter, stop and tell me.

3. Run the bundled installer from the package folder. It detects the wired NIC,
   reuses or creates the external switch, imports the VM with a new unique ID
   (Generation 2, Secure Boot OFF, MAC spoofing On), and connects the adapter:
   cd "<PACKAGE_PATH>"
   .\Import-RTA.ps1
   Expect a brief (one to three second) network blip as the NIC is re-bound to the
   switch. If the script detects a wireless default route it will make me type yes
   to acknowledge the limitation. Do NOT pass -Force or bypass that prompt for me:
   stop and tell me, so I can connect a wired cable and rerun instead.

4. Confirm the import landed and the firmware is correct before starting:
   Get-VM -Name "<VM_NAME>" | Select-Object Name,State,Generation
   (Get-VMFirmware -VMName "<VM_NAME>").SecureBoot
   Expect Generation 2 and SecureBoot Off. If SecureBoot is On, stop and tell me:
   do NOT start the VM and do NOT enable Secure Boot to "fix" it. An enabled Secure
   Boot black-screens the appliance with "The unsigned image's hash is not allowed".

5. Start the VM:
   Start-VM -Name "<VM_NAME>"

VERIFY:
6. Confirm it is running:
   Get-VM -Name "<VM_NAME>" | Select-Object Name,State
   Expect State Running.

7. Open the console to read the one-time activation code. In Hyper-V Manager,
   right-click <VM_NAME> and choose Connect (this opens VMConnect). About a minute
   after boot it shows an "Appliance Registration" screen with a short code (for
   example "4 5 D C V Y"). Read that code back to me exactly. Do NOT send it
   anywhere yourself: I give it to my Sophos engagement lead, who activates the
   appliance. The screen stays up until activation, so if you miss it, reconnect
   the console. After activation the console switches to a live status dashboard.

RULES YOU MUST FOLLOW:
- These steps are authoritative. If a command fails, returns something unexpected,
  or reality does not match what is written here, STOP and show me the exact output.
  Do not improvise, invent flags, or try alternative commands on your own.
- The appliance needs exactly ONE connection: an outbound tunnel on TCP/443 to
  connect.remotetesting.secureworks.com. Never open, forward, or allow any INBOUND
  port to it. If connectivity fails, the problem is on the outbound path, never a
  missing inbound rule.
- Never enable Secure Boot and never change the firmware or boot type away from what
  these steps specify (UEFI / Generation 2). The appliance will not boot otherwise.
- Do not SSH into, log in to, or reconfigure the appliance. Once it boots it
  provisions itself; there is nothing to set up inside it.
- Every value in angle brackets (<LIKE_THIS>) must come from me. Never guess, invent,
  or reuse one. Ask me for any you do not have before running the step that needs it.
- Do not weaken security to force the connection (do not disable TLS inspection, and
  do not turn off a firewall). If something is blocked, tell me what and let me decide.
- Do only what these steps describe: deploy this one appliance. Do not create extra
  resources, install extra software, or take any action beyond that.

Network access

The appliance makes one connection to do its job: an outbound tunnel to the Sophos headend. Nothing inbound is ever required: you never open or forward any ports to the appliance.

Allow this outbound destination

Destination	connect.remotetesting.secureworks.com
IP addresses	3.33.194.251 and 15.197.255.2 (static; these do not change)
Port / protocol	TCP 443, carrying OpenVPN (not HTTPS)
Direction	Outbound only

Allow egress on TCP/443 to that destination from the appliance's network. On a next-generation firewall or NAC-controlled network, an L3 "allow 443" rule is often not enough: Layer-7 application control, TLS/SSL decryption, or NAC can still drop the tunnel even when the port is open. See Connectivity troubleshooting for the exact firewall and NAC exceptions to request.

Troubleshooting

Deployed but something isn't right?

See this platform's troubleshooting guide for the most common issues here and how to fix them.