ESXi Host Client missing "Manage" tab, VM actions grayed out, and VMRC fails with "ticketType" error

Products

• VMware vSphere ESXi

Issue/Introduction

When logging into the ESXi Host Client with the root account, you experience the following symptoms:

• The Manage tab is entirely missing from the Navigator pane.
• All Virtual Machine actions (Power On, Shut Down, Edit Settings) are grayed out.
• Attempting to open the virtual machine console via VMRC fails with the pop-up error: Unable to connect to the MKS; A specified parameter was not correct: ticketType.
• Attempting to navigate directly to /ui/#/host/manage/security/users shows an empty list.
• SSH or Direct Console User Interface (DCUI) access may reject the root password.
• Lockdown Mode is confirmed to be Disabled.
• When attempting to remediate the host via vCenter using a Host Profile, compliance fails with the error: Host profile apply failed with error: Cannot remove last local user with full administrative privileges.
• From ESXi - /var/log/hostd.log may report vim.fault.NoPermission messages
• From ESXi - /var/log/auth.log may report pam_access(sshd:auth): access denied for user root

Environment

• VMware ESXi 7.0
• VMware ESXi 8.0

Cause

This issue occurs when the local root account permission role is altered from Administrator to Read-Only in the host's ConfigStore. This is typically triggered by a Lockdown Mode cycle (enabling and then immediately disabling Lockdown Mode), where the exit process fails to restore the default Administrator permission to the root account.

Because root lacks the Administrator role:

1. The Host Client UI automatically hides management tabs and restricts VM power states.
2. The ticketType error occurs because the session lacks the VirtualMachine.Interact.ConsoleInteract privilege, causing the backend to pass an invalid parameter to the VMRC client.
3. The Host Profile fails because a secondary local user (e.g., CIMAdmin) is currently the only account holding Administrator rights. Applying the profile would overwrite this user, leaving the host with zero administrators, triggering the ESXi safety block.
   
   
   

Resolution

To resolve this issue, you must use an alternate local ESXi account that retains Administrator privileges (such as a custom admin or a service account like CIMAdmin) to restore the root account's permissions.

Step 1: Restore root permissions via the Host Client

1. Log into the affected ESXi Host Client using the alternate administrative account (e.g., CIMAdmin).
2. In the Navigator pane on the left, right-click Host (or click the Actions gear icon at the top of the UI) and select Permissions. (Note: Do not navigate to Manage > Security & users > Users, as permissions cannot be mapped there).
3. Locate the root user in the permissions list. It will likely show a role of Read-Only.
4. Select the root user and click Assign role. Change the assigned role to Administrator. (If root is missing entirely, click Add user, type root, and assign the Administrator role).
5. Log out of the ESXi Host Client and log back in as root. The Manage tab, VM actions, and VMRC console access will be restored.

Alternative Workarounds:

If no alternate local administrative account exists, the permissions must be restored via the command line or a reinstall:

• If SSH/DCUI access is still possible:
  1. Log into the ESXi shell
  2. Run the following to refresh the authorization file
     • cp /etc/vmware/hostd/authorization.xml.default /etc/vmware/hostd/authorization.xml
  3. Restart the management agents
     • /etc/init.d/hostd restart.
• If all access is lost:
  1. Boot the host from the ESXi installation ISO
  2. Select Install ESXi
  3. Choose the Preserve VMFS Datastore option. This will safely reset the host's OS configuration and root password without affecting the virtual machines on the datastore.
  4. Run the reinstallation.

Additional Information

• For steps to download the latest ESXi releases and patches, see Download Broadcom Products and Software.
• For more information on managing host access, see Enabling or disabling Lockdown mode on an ESXi host.