vStrong.info

Q: What is Lockdown Mode?
A: Lockdown Mode prevents users from logging directly to the host. The host will only be accessible through local console or vCenter Server. None of remote management options e.g. vCLI, PowerCLI script, SSH will work. When it is enabled, only vpxuser () has authentication permissions and can connect to the host remotely.

How can you enable/disable Lockdown Mode:

1. From the Direct Console User Interface (DCUI);
2. From vSphere Client;
3. Using ESXi Shell;
4. Using PowerCLI script.

1. Enable/Disable Lockdown Mode from DCUI:

1. Open server console;
2. Press F2 to Customize System/View Logs;
3. Open Configure Lockdown Mode;
4. Press SPACE to enable or disable lockdown mode;
   
5. Press ENTER to save the changes.

2. Enable/Disable Lockdown Mode in vSphere Client:

1. Open vSphere Client and connect to the host / vCenter Server;
2. Select the host and click on Configuration tab;
3. Under Software select Security Profile;
4. Under Lockdown Mode click Edit;
5. Tick / Untick Enable Lockdown Mode;
   
6. Click OK.

3. Enable/Disable Lockdown Mode in ESXi Shell:

Check if Lockdown mode is enabled: vim-cmd -U dcui vimsvc/auth/lockdown_is_enabled
Enable Lockdown mode: vim-cmd -U dcui vimsvc/auth/lockdown_mode_enter
Disable Lockdown mode: vim-cmd -U dcui vimsvc/auth/lockdown_mode_exit

Example:

~ # vim-cmd -U dcui vimsvc/auth/lockdown_is_enabled
false
~ # vim-cmd -U dcui vimsvc/auth/lockdown_mode_enter
~ # vim-cmd -U dcui vimsvc/auth/lockdown_is_enabled
true
~ # vim-cmd -U dcui vimsvc/auth/lockdown_mode_exit
~ # vim-cmd -U dcui vimsvc/auth/lockdown_is_enabled
false

4. Enable/Disable Lockdown Mode using PowerCLI script:

$vCenter = 'vCenterServer_Name_or_IP_address'
Connect-VIServer $vCenter
 $Scope = Get-VMHost #This will change the Lockdown Mode on all hosts managed by vCenter, amend this if you need to
 foreach ($ESXhost in $Scope) {
 (get-vmhost $ESXhost | get-view).ExitLockdownMode() # To DISABLE Lockdown Mode
 # (get-vmhost $ESXhost | get-view).EnterLockdownMode() # To ENABLE Lockdown Mode
 }
Disconnect-VIServer -Server $vCenter -Confirm:$false

This script creates a new user and adds the user to a role on the ESX host:

$NewUser = '_New_user_name_'
$NewUserPassword = '_New_user_Password_'
$NewUserDesc = '_New_user_description_'
$HOSTCredentials = Get-Credential -Credential root
$ESXhost = '_My_ESX_HOST_'

Connect-VIServer $ESXhost -Credential $HOSTCredentials
New-VMHostAccount -Id $NewUser -Password $NewUserPassword -Description $NewUserDesc -UserAccount -Server $ESXhost -AssignGroups users
$AuthMgr = Get-View (Get-View ServiceInstance).Content.AuthorizationManager
$Entity = Get-Folder ha-folder-root | Get-View
$Perm = New-Object VMware.Vim.Permission
$Perm.entity = $Entity.MoRef
$Perm.group = $false
$Perm.principal = $NewUser
$Perm.propagate = $true
# You can either specify roleID or use the line below if you know the role name.
# $Perm.roleId = ($AuthMgr.RoleList | where {$_.Name -eq "ReadOnly"}).RoleId
$Perm.roleId = "-2"
$AuthMgr.SetEntityPermissions($Entity.MoRef,$Perm)

Disconnect-VIServer -Server $ESXhost -Confirm:$false

Here is the list of common roles / role IDs:

RoleName                     Label                                    RoleId
--------                     -----                                    ------
NoAccess                     No access                                -5
Anonymous                    Anonymous                                -4
View                         View                                     -3
ReadOnly                     Read-only                                -2
Admin                        Administrator                            -1
VirtualMachinePowerUser      Virtual machine power user (sample)      4
VirtualMachineUser           Virtual machine user (sample)            5
ResourcePoolAdministrator    Resource pool administrator (sample)     6
VMwareConsolidatedBackupUser VMware Consolidated Backup user (sample) 7
DatastoreConsumer            Datastore consumer (sample)              8
NetworkConsumer              Network consumer (sample)                9

For the full list of Roles you have in your environment please use this script:

$report =@()
$authMgr = Get-View AuthorizationManager
foreach($role in $authMgr.RoleList){
$row = "" | Select RoleName, Label, RoleId
$row.RoleName = $role.Name
$row.Label = $role.Info.Label
$row.RoleId = $role.RoleId
$report += $row
}
$report