ESXCLI and Lockdown Mode

Lockdown mode can disable all direct root access to ESXi machines.

To make changes to ESXi systems in lockdown mode you must go through a vCenter Server system that manages the ESXi system. You can use the vSphere Client or ESXCLI commands that support the --vihost option.

If you have problems running a command on an ESXi host directly, without specifying a vCenter Server target, check whether lockdown mode is enabled on that host. See the vSphere Security documentation.