Resolving the “ExecInstalledOnly Has Been Disabled” Warning After Upgrading ESXi Hosts to 8.x

After upgrading VMware ESXi hosts to version 8.x administrators may see the following informational message on the host summary page in the vSphere Client:

“ExecInstalledOnly has been disabled. This allows the execution of non-installed binaries on the host. Unknown content can cause malware attacks similar to ransomware.”

This message does not necessarily indicate a service outage or a critical ESXi failure. However, it should not be ignored because it means that an important ESXi security mechanism is currently disabled.

This article explains what the ExecInstalledOnly feature does, why the warning may appear after an ESXi 8.x upgrade, and how to safely enable the setting again.

What Is ExecInstalledOnly?

ExecInstalledOnly is an ESXi security feature that allows only trusted and properly installed executable files to run on the host.

When this feature is enabled, ESXi generally permits executables that meet the following conditions:

• The file was installed through a VIB package.
• The file has not been modified after installation.
• ESXi recognizes the file as part of an installed and trusted component.

A VIB, or vSphere Installation Bundle, is the software packaging format used to install ESXi drivers, agents, extensions, and system components.

When ExecInstalledOnly is enabled, executables that were manually copied to the host, extracted from an archive, or installed outside a trusted VIB package may be blocked.

This helps reduce the risk of unauthorized tools, malicious binaries, and ransomware-related components being executed directly on the ESXi host.

What Changed in ESXi 8.x?

When ESXi 8.0 or a later version is installed, the ExecInstalledOnly Internal Runtime setting is enabled by default.

The default setting is:

/User/ExecInstalledOnly = 1

The possible values are:

0 = Disabled
1 = Enabled

However, after an upgrade to ESXi 8.x, the setting may remain disabled during the first boot.

In some environments, hardware vendor firmware tools or third-party maintenance utilities may also temporarily disable this security control so that their own executables can run.

If the tool does not enable the setting again after the maintenance operation is completed, the warning remains visible in the vSphere Client.

Common Reasons for the Warning

The warning may appear for several reasons.

ESXi Version Upgrade

After upgrading from ESXi 7.x to ESXi 8.x, the setting may not return to its expected default value during the first boot.

Manual Configuration Change

An administrator may have disabled ExecInstalledOnly to run a utility that was not installed through a VIB package.

Firmware Update Tools

Some server vendor firmware update tools temporarily disable the setting so that their update executables can run on the ESXi host.

Once the firmware update is complete, the setting may remain disabled unless it is manually enabled again.

Third-Party Utilities

Hardware diagnostic tools, storage utilities, monitoring agents, or vendor support tools copied directly to the ESXi host may not be packaged as VIB files.

In such cases, ExecInstalledOnly may block the utility, causing administrators or installation tools to disable the feature temporarily.

For a permanent solution, the software vendor should provide an ESXi-supported VIB package whenever possible.

Checking the Current ExecInstalledOnly Status

First, enable SSH or ESXi Shell access on the affected host.

Then run the following command:

esxcli system settings advanced list -o /User/execInstalledOnly

If the feature is disabled, the output will look similar to the following:

Path: /User/ExecInstalledOnly
Type: integer
Int Value: 0
Default Int Value: 1
Min Value: 0
Max Value: 1

The most important field is:

Int Value: 0

A value of 0 confirms that the ExecInstalledOnly Internal Runtime setting is disabled.

Enabling ExecInstalledOnly

To enable the security feature again, run the following command:

esxcli system settings advanced set -o /User/execInstalledOnly -i 1

After applying the change, verify the setting again:

esxcli system settings advanced list -o /User/execInstalledOnly

The expected output should contain:

Path: /User/ExecInstalledOnly
Type: integer
Int Value: 1
Default Int Value: 1
Min Value: 0
Max Value: 1

An Int Value of 1 confirms that the feature has been enabled successfully.

Is an ESXi Host Reboot Required?

According to Broadcom’s technical documentation, this change is applied to an internal runtime setting.

Therefore, restarting the ESXi host is generally not required.

The setting normally takes effect immediately after the command is executed.

The vSphere Client may require a page refresh or the host summary page may need to be reopened before the informational message disappears.

Runtime and VMkernel Boot Settings Are Different

ESXi contains more than one setting related to ExecInstalledOnly. These settings should not be confused with each other.

Internal Runtime Setting

The warning discussed in this article is associated with the following setting:

/User/ExecInstalledOnly

Use the following command to check it:

esxcli system settings advanced list -o /User/execInstalledOnly

Use the following command to enable it:

esxcli system settings advanced set -o /User/execInstalledOnly -i 1

This runtime setting usually does not require a reboot.

VMkernel Boot Setting

ESXi also includes the following VMkernel boot option:

VMKernel.Boot.execInstalledOnly

This option is related to boot-level enforcement and is separate from the internal runtime setting.

Changes to VMkernel boot settings may require an ESXi host reboot.

Therefore, when the informational message described in Broadcom Knowledge Base Article 401376 appears, administrators should first check the /User/ExecInstalledOnly runtime value.

VMkernel boot, TPM, or Secure Boot enforcement settings should not be changed unless they are directly related to the issue being investigated.

What Should You Do If the Setting Was Disabled Intentionally?

If ExecInstalledOnly was intentionally disabled to perform a firmware update or run a hardware diagnostic tool, the message may be temporarily expected.

After the operation is complete, follow these steps:

1. Confirm that the firmware or maintenance operation has finished.
2. Verify that the third-party utility is no longer running.
3. Enable ExecInstalledOnly again.
4. Confirm that the setting value is 1.
5. Refresh the vSphere Client and verify that the warning has disappeared.
6. Disable SSH and ESXi Shell access if they are no longer required.

Leaving the feature disabled permanently allows executables that were not installed through trusted VIB packages to run on the host.

For production environments, the setting should only be disabled temporarily, for a documented reason, and preferably during a controlled maintenance window.

Checking ESXi Logs

When ExecInstalledOnly blocks an executable, related events may appear in the following log file:

/var/log/vobd.log

Example messages may include:

Execution of non-installed file prevented

or:

vob.uw.exec.installonly.violation

These entries indicate that an executable was blocked because it was not installed through a trusted ESXi installation package.

To search the log file, use:

grep -i "execInstalledOnly" /var/log/vobd.log

To monitor the log in real time, use:

tail -f /var/log/vobd.log | grep -i "execInstalledOnly"

Checking Multiple ESXi Hosts with PowerCLI

In environments with multiple ESXi hosts, PowerCLI can be used to check the setting across the infrastructure.

Get-VMHost | ForEach-Object {
    $VMHost = $_

    $Setting = Get-AdvancedSetting `
        -Entity $VMHost `
        -Name "User.ExecInstalledOnly" `
        -ErrorAction SilentlyContinue

    [PSCustomObject]@{
        VMHost            = $VMHost.Name
        ConnectionState   = $VMHost.ConnectionState
        ExecInstalledOnly = $Setting.Value
    }
}

The exact Advanced Setting name may vary depending on the ESXi build or how the setting is exposed through vCenter Server.

Before applying changes across multiple production hosts, test the procedure on a single non-critical host.

Recommended Troubleshooting Procedure

When the warning appears, use the following process:

1. Identify which ESXi hosts display the warning.
2. Check whether firmware updates or third-party tools were recently used.
3. Query the /User/ExecInstalledOnly setting.
4. If the value is 0, determine why the setting was disabled.
5. If there is no valid operational requirement, change the value to 1.
6. Verify that the setting is enabled.
7. Refresh the vSphere Client and confirm that the warning is cleared.
8. Disable SSH and ESXi Shell if they are no longer needed.

The ExecInstalledOnly has been disabled message seen after an ESXi 8.x upgrade is not normally a critical host failure.

However, it indicates that an important ESXi security feature is disabled.

The current value can be checked with:

esxcli system settings advanced list -o /User/execInstalledOnly

The feature can be enabled with:

esxcli system settings advanced set -o /User/execInstalledOnly -i 1

After the change, confirm that the Int Value is set to 1.

Because this is an internal runtime setting, the change normally takes effect immediately and does not require an ESXi host reboot.

Checking this setting after ESXi upgrades, firmware updates, and third-party maintenance operations helps ensure that unauthorized or untrusted executables cannot run on the host.

Source: Broadcom Knowledge Base Article 401376 – “Hosts upgraded to 8.x show informational message that ExecInstalledOnly has been disabled.”