Failed to log in to the ESXi host UI with root account due to Lockdown Mode

Products

• VMware vSphere ESXi

Issue/Introduction

• ESXi host UI access fails with error: "Permission to perform this operation was denied."

         

• SSH access to the host is unavailable or denied.
• Virtual machines continue running normally on the host, but direct host management is restricted.

         

 

Environment

VMware ESXi 6.x  

VMware ESXi 7.x

VMware ESXi 8.x

Cause

Lockdown Mode (Normal or Strict) was enabled on the ESXi host, restricting direct authentication to local management interfaces (Host Client, SSH, and PowerCLI) and enforcing management solely through vCenter Server.

Resolution

Option 1: Disable Lockdown Mode via vCenter Server (Recommended)

If the host is managed and connected to vCenter:

1. Log in to the vSphere Client.
2. Select the ESXi host in the inventory.
3. Go to Configure > System > Security Profile.
4. In the Lockdown Mode panel, click Edit and select Disabled.

Option 2: Disable Lockdown Mode via DCUI (Normal Lockdown Mode)

If direct connection to vCenter is lost but DCUI is accessible:  

1. Access the host console via LOM (iDRAC, iLO, KVM) or local monitor.
2. Press F2 to open the Direct Console User Interface (DCUI).
3. Authenticate using the root credentials (or an authorized DCUI Access user).
4. Select Configure Lockdown Mode and press Enter to toggle it to Disabled.
5. Save changes and exit.

Option 3: Recovering from Strict Lockdown Mode

If Strict Lockdown Mode was enabled and the host lost connection to vCenter:

1. Access via DCUI will be disabled.
2. If SSH/ESXi Shell was not pre-configured with Exception Users, Connectivity to vCenter Server must be restored or reinstall the ESXi host to regain management access.