Skip to content

Hyper-V (Windows 11): CLI (PowerShell)

Import and start the RTA with a single elevated PowerShell command. The Import-RTA.ps1 script included in the package handles everything: NIC detection, external switch creation, VM import, and networking, with guard rails for the most common mistakes.

Before you start

Review the Hyper-V (Windows 11) overview. You'll need the extracted contents of sophos-rta-hyperv.zip and a wired Ethernet NIC with internet egress. The script must be run as Administrator.

Quick deploy

Experienced operators can work straight from this outline; the detailed walkthrough follows below.

  1. Extract sophos-rta-hyperv.zip to a plain ASCII path (e.g. C:\RTA).
  2. In an elevated PowerShell, cd C:\RTA and run .\Import-RTA.ps1. It detects your wired NIC, creates the external switch, imports the VM, and confirms MAC spoofing.
  3. Start-VM -Name "Sophos-RTA".
  4. Open the console, read the one-time activation code, and send it to your engagement lead.

Use a wired Ethernet NIC; Wi-Fi will degrade the engagement

The appliance needs Layer-2 adjacency to on-premises targets for techniques such as ARP poisoning, MITM, and host discovery. Hyper-V cannot bridge a Wi-Fi adapter as a true L2 peer; over Wi-Fi the VM gets internet but cannot act as a distinct host on the LAN. Running the RTA on Wi-Fi degrades the quality of the engagement and is strongly discouraged: use a wired Ethernet NIC.

1. Extract the package

Extract sophos-rta-hyperv.zip to a local path; avoid paths with spaces or non-ASCII characters. A top-level folder such as C:\RTA\ works well.

After extraction you should have:

C:\RTA\
├── README.md
├── Import-RTA.ps1
└── Sophos-RTA\
    ├── Virtual Machines\
    └── Virtual Hard Disks\

2. Open an elevated PowerShell

Right-click Start → Windows PowerShell (or Terminal) and choose Run as Administrator. The script pre-flights for elevation and will exit with a clear error if it is not running as Administrator.

3. Run the installer

Change to the folder where you extracted the zip and run:

cd C:\RTA
.\Import-RTA.ps1

The script will:

  1. Verify it is running as Administrator and that the Hyper-V feature is enabled.
  2. Detect the physical NIC that carries your default internet route.
  3. Reuse an existing external switch on that NIC, or create one named RTA-External. You will see a brief network blip (one to three seconds) as the NIC is re-bound to the virtual switch.
  4. Import the VM using a new unique ID (Compare-VM -Copy -GenerateNewId).
  5. Connect the VM's network adapter to the external switch and confirm MAC address spoofing is On.
  6. Print the VM name and the command to start it.

The script guards against Wi-Fi

If your default route is through a wireless adapter (see the wired-NIC warning above), the script makes you type yes to acknowledge the limitation before continuing; -Force skips the prompt for automated workflows.

.\Import-RTA.ps1 -Force

Connect a wired Ethernet cable and rerun the script; it picks up the wired NIC automatically.

4. Start the VM

The script prints the exact command. It will look like:

Start-VM -Name "Sophos-RTA"

You can also start it from Hyper-V Manager by right-clicking the VM and choosing Start.

Verify

Confirm the VM is running, then open Hyper-V Manager, select the VM, and click Connect to open the VM console.

Get-VM -Name "Sophos-RTA"
# State should show: Running

Send us the activation code

The Win11 Hyper-V package is a generic image, so on first boot the appliance comes up in activation mode. Read the code from the VM console.

The console shows the Appliance Registration screen: a one-time activation code (for example 4 5 D C V Y) under the prompt "Provide this code to your Sophos staging team." You do not log in to the appliance to read it.

Send that activation code to your Sophos engagement lead so they can activate the appliance on the Sophos side. Once activated, the console switches from the registration screen to the appliance's live status dashboard, and no further action is needed on your end.

Registration needs outbound 443 to get.remotetesting.secureworks.com

Registration and activation use outbound TCP/443 (HTTPS) to get.remotetesting.secureworks.com, in addition to the OpenVPN tunnel to connect.remotetesting.secureworks.com covered under Network access below. Its IP addresses are not guaranteed to stay constant, so allowlist get.* by FQDN (not by IP). If that egress is blocked, the console shows a registration error ("ensure outbound HTTPS to get.remotetesting.secureworks.com") instead of an activation code.

If you miss the code

The appliance keeps the Appliance Registration screen displayed until the device is activated. If you miss it, reconnect the console and it will still be there.

Network access

The appliance makes one connection to do its job: an outbound tunnel to the Sophos headend. Nothing inbound is ever required: you never open or forward any ports to the appliance.

Allow this outbound destination
Destination connect.remotetesting.secureworks.com
IP addresses 3.33.194.251 and 15.197.255.2 (static; these do not change)
Port / protocol TCP 443, carrying OpenVPN (not HTTPS)
Direction Outbound only

Allow egress on TCP/443 to that destination from the appliance's network. On a next-generation firewall or NAC-controlled network, an L3 "allow 443" rule is often not enough: Layer-7 application control, TLS/SSL decryption, or NAC can still drop the tunnel even when the port is open. See Connectivity troubleshooting for the exact firewall and NAC exceptions to request.

Troubleshooting

Deployed but something isn't right?

See this platform's troubleshooting guide for the most common issues here and how to fix them.