6.7

Procedure
1 Browse to a host in the vSphere Web Client inventory, and select a host.
2 Click Configure.
3 Under System, select Security Profile and click Edit.
4 Scroll to the service that you wish to change.
5 In the Service Details pane, select Start, Stop, or Restart for a one-time change to the host's status,
or select from the Startup Policy menu to change the status of the host across reboots.
n
Start automatically if any ports are open, and stop when all ports are closed: The default
setting for these services. If any port is open, the client attempts to contact the network resources
for the service. If some ports are open, but the port for a particular service is closed, the attempt
fails. If and when the applicable outgoing port is opened, the service begins completing its
startup.
n
Start and stop with host: The service starts shortly after the host starts, and closes shortly
before the host shuts down. Much like Start automatically if any ports are open, and stop
when all ports are closed, this option means that the service regularly attempts to complete its
tasks, such as contacting the specified NTP server. If the port was closed but is subsequently
opened, the client begins completing its tasks shortly thereafter.
n
Start and stop manually: The host preserves the user-determined service settings, regardless of
whether ports are open or not. When a user starts the NTP service, that service is kept running
as long as the host is powered on. If the service is started and the host is powered off, the service
is stopped as part of the shutdown process, but as soon as the host is powered on, the service is
started again, preserving the user-determined state.
Note These settings apply only to service settings that are configured through the
vSphere Web Client or to applications that are created with the vSphere Web Services SDK.
Configurations made through other means, such as from the ESXi Shell or with configuration files, are
not affected by these settings.
Lockdown Mode
To increase the security of your ESXi hosts, you can put them in lockdown mode. In lockdown mode,
operations must be performed through vCenter Server by default.
Starting with vSphere 6.0, you can select normal lockdown mode or strict lockdown mode, which offer
different degrees of lockdown. vSphere 6.0 also introduces the Exception User list. Exception users do
not lose their privileges when the host enters lockdown mode. Use the Exception User list to add the
accounts of third-party solutions and external applications that need to access the host directly when the
host is in lockdown mode. See Specify Lockdown Mode Exception Users.
Lockdown Mode in vSphere 6 (http://link.brightcove.com/services/player/bcpid2296383276001?
bctid=ref:video_lockdown_mode_vsphere)
vSphere Security
VMware, Inc. 76