Nessus

Nessus quick install on Kali

To fire off a quick install on the Kali side, head to the Tenable downloads page and then copy the curl command to grab the installer, which will look something like:

curl --request GET \
  --url 'https://www.tenable.com/downloads/api/v2/pages/nessus/files/Nessus-10.8.2-debian10_amd64.deb' \
  --output 'Nessus-10.8.2-debian10_amd64.deb'

Kick off the install

sudo dpkg -i Nessus-x.deb

Startup the Nessus service

sudo systemctl start nessusd.service

Finish configuration

Then visit your install at https://your.nessus.ip.address:8834 and continue with the rest of the install and setup.

Watch main nessusd.messages file

This is the file that will show things such as services starting up/down, plugin updates being applied, etc.

sudo tail -f /opt/nessus/var/nessus/logs/nessusd.messages

On Windows, the nessusd.messages file is in C:\ProgramData\Tenable\Nessus\nessus\logs\nessusd.messages

Reset forgotten password

If you at least know the username you can reset the forgotten password (Windows):

cd "c:\Program Files\Tenable\Nessus"
nessus chpasswd USER-GOES-HERE

Policy setup

Here's a basic internal policy to scan all the things using an AD account:

Click Policies from the left-hand menu.
Click New Policy.
Choose Advanced Scan. Give the policy a name and (optionally) a description.

Discovery → Host Discovery

Uncheck Test the local Nessus host — we don't need our local box mucking up the scan.
Uncheck Scan Network Printers — scanning printers can sometimes make them print novels of garbage.

Report

Uncheck Show missing patches that have been superseded.

A superseded patch is one that doesn't need to be installed because a later patch corrects the same vulnerability. A service pack is a good example — it may contain many smaller patches/fixes. If this setting is enabled, Nessus will report each underlying vulnerability individually. Leaving it off keeps the results focused on the "big fixes" to help plan patching accordingly.
Check Designate hosts by their DNS name.

Useful for DHCP scopes where machines often change IPs over time.

Advanced

Check Enable safe checks.
Check Slow down the scan when network congestion is detected.
Performance Options - check out this tip:

See the Nessus scan tuning guide for guidance.

What's annoying about this guide is it doesn't recommend specific values for the "max simultaneous checks per host" etc. However, during a support chat an agent offered this guidance:

For Max Simultaneous Checks Per Host, The recommended default is 5. This determines how many vulnerability tests are run against a single machine at once. Increasing this can speed up the scan for that specific host, but it also increases the risk of performance impact on that host or triggering network security defenses.
For the Max Simultaneous Hosts Per Scan, the standard default for a Nessus Professional scanner is typically 30. While you mentioned seeing a suggestion of 256, this is generally a high-end cap for significantly more powerful hardware. For a 4-core system, a value of 30 is a well-balanced starting point that provides good performance without over-utilizing CPU resources.
To avoid overwhelming your network, ensure the "Slow down the scan when network congestion is detected" setting is enabled in your Advanced policy settings. This allows Nessus to automatically throttle itself if it detects that the network pipe is reaching capacity.

Check Log scan details (optional).

This logs the start/finish time for each plugin used in a scan (details written to nessusd.messages). Handy for troubleshooting scans and pinpointing exactly when Nessus was scanning a given host. Note: on large scans, nessusd.messages can consume significant disk space — keep an eye on it.

Credentials Tab

Click Windows and provide a domain admin username and password.
Check Start the Remote Registry service during the scan.

Allows Nessus to read keys and values from the registry.
Check Enable administrative shares during the scan.

Enables the C$ and ADMIN$ shares for the duration of the scan, then disables them when the scan finishes.

Plugins Tab

All plugins should already be selected by default. Do a spot check and confirm all Plugin Family entries are set to Enabled.

Troubleshooting

Fix "installation expired" error

If you fire up the GUI URL and get this error:

Installation Expired
This installation has expired.  If you believe that you are are seeing this screen in error, please take one of the following corrective actions...

(and then you're presented with some contact options)

Here's how you fix (on Windows):

cd "c:\Program Files\Tenable\Nessus"
nessuscli.exe fetch --register xxx
net stop "tenable nessus"
net start "tenable nessus"

Last updated on 2026-07-19 by Brian Johnson