When you install or upgrade to ESXi 8.0 or later, the execInstalledOnly internal runtime option is activated on hosts by default. This option helps protect your hosts against ransomware attacks. If your ESXi 8.0 or later hosts still run non-VIB binaries from external sources, you can deactivate the execInstalledOnly internal runtime option.

The execInstalledOnly option helps protect your hosts against ransomware attacks by ensuring that the VMkernel executes only those binaries on a host that have been properly packaged and signed as part of a valid VIB.

The execInstalledOnly option is both a boot and an internal runtime option. The execInstalledOnly boot option, also called a kernel option, was introduced in ESXi 5.5. The execInstalledOnly boot option is deactivated by default. In vSphere 7.0 Update 2 and later, you can enforce the execInstalledOnly boot option upon every boot by using a TPM. For more information, see Activate or Deactivate the execInstalledOnly Enforcement for a Secure ESXi Configuration.

The execInstalledOnly internal runtime option added in ESXi 8.0 is activated on hosts by default. The execInstalledOnly boot option continues to be deactivated by default, except a previously enabled execInstalledOnly boot option overwrites the internal runtime option if you set both.

Note: The execInstalledOnly option is independent of Secure Boot. Secure boot checks that all installed VIBs are signed. For more information, see UEFI Secure Boot for ESXi Hosts.

When you deactivate the execInstalledOnly internal runtime option, vCenter Server warnings appear for the host.

Prerequisites

To deactivate the execInstalledOnly internal runtime option, you must have root access to the ESXi host. You can use ESXCLI, PowerCLI, or the API. The task that follows uses ESXCLI.
Caution: Deactivating the execInstalledOnly internal runtime option leaves you more vulnerable to attacks.

Procedure

  1. Connect to the ESXi host by SSH.
  2. To deactivate the execInstalledOnly internal runtime option, enter the following ESXCLI command. 
    esxcli system settings advanced set -o /User/execInstalledOnly -i 0