Repetitive ESXi Lockdown Mode and SSH Tasks Triggered by Zerto Replication

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

• vCenter Server task console shows frequent and repetitive entries for "Enter Lockdown Mode", "Exit Lockdown Mode" or "Change lockdown mode", and "Start/Stop SSH Service" on one or more ESXi hosts.
• The "User" associated with these tasks is often a local SSO account or a dedicated Zerto service account.
  
  

Cause

This behavior is typically driven by the configuration of third-party backup solutions, specifically Zerto. These tools may be configured to authenticate via a service account that enables SSH and toggles Lockdown Mode to perform necessary data movement or metadata processing on the ESXi host.

When a backup or replication task starts, the application may temporarily disable Lockdown Mode and start SSH to gain direct host access, reverting the settings once the task completes.

Resolution

This behavior is often by design for certain Zerto configurations.

For detailed guidance on how Zerto interacts with ESXi security settings or to change this programmatic behavior, contact Zerto Support for further validation.