ESXCLI and Lockdown Mode

Lockdown mode can disable all direct root access to
ESXi
machines.
To make changes to
ESXi
systems in lockdown mode you must go through a
vCenter Server
system that manages the
ESXi
system. You can use the
vSphere Client
or ESXCLI commands that support the
--vihost
option.
If you have problems running a command on an
ESXi
host directly, without specifying a
vCenter Server
target, check whether lockdown mode is enabled on that host. See the
vSphere Security
documentation.