vSphere and ESXi Host Configuration and Maintenance
Where host configuration lives
An ESXi host can be configured from the DCUI on the console, the ESXi Host Client, esxcli from the shell, or vCenter (Host > Configure). Knowing which path a question implies is half the battle: some settings (host profiles, image-based lifecycle, cluster-level services) exist only through vCenter, while networking, DNS/NTP, and service control are all available locally.
Concepts you must know
- Service control: ESXi Shell, SSH, NTP daemon, slpd, CIM. Disabling a service does not terminate existing sessions.
- Lockdown mode: Normal keeps DCUI usable by users holding the DCUI User privilege; Strict disables DCUI access except for added exception users. Exception users keep their normal permissions.
- Time: NTP is mandatory for certificates, SSO, HA and vSAN. Set it via Host Client or
esxcli system ntp. - Maintenance mode: evacuates VMs, triggers DRS/HA reactions, and gates patching. Use
esxcli system maintenanceMode set --enable truewhen vCenter is unreachable. - Host profiles vs. image lifecycle: profiles enforce configuration; images deliver VIBs/drivers.
Traps
Questions often swap the root account and vCenter SSO accounts, assume SSH disabling kills live sessions, or imply a host in maintenance mode still serves vSAN storage (it does not contribute capacity for new objects). Another classic: host profile compliance is not the same as remediation, and a profile can be checked without being applied.
Rule of thumb
If a change alters the boot image (driver, VIB), use vLCM or esxcli software vib; if it alters configuration, prefer vCenter or a host profile so the setting is captured and repeatable after a rebuild.