Integrated Dell Remote Access Controller 9 User's Guide

PDF

System Configuration Lockdown mode

System Configuration Lockdown mode helps in preventing unintended changes after a system is provisioned. Lockdown mode is applicable to both configuration and firmware updates. When the system is locked down, any attempt to change the system configuration is blocked. If any attempts are made to change the critical system settings, an error message is displayed. Enabling System lockdown mode blocks the firmware update of third party I/O cards using the vendor tools.

System Lockdown mode is only available for Enterprise licensed customers.

In 4.40.00.00 release, System lockdown functionality is extended to NIC's also.

NOTE Enhanced Lockdown for NIC's only includes firmware lockdown to prevent firmware updates. Configuration (x-UEFI) lockdown is not supported.

NOTE After the System Lockdown mode is enabled, you cannot change any configuration settings. System settings fields are disabled.

Lockdown mode can be enabled or disabled using the following interfaces:

iDRAC web interface
RACADM
WSMan
SCP (System Configuration Profile)
Redfish
Using F2 during POST and selecting iDRAC Settings
Factory System Erase

NOTE To enable Lockdown mode, you must have iDRAC Enterprise or Datacenter license and Control and Configure system privileges.

NOTE You may be able to access vMedia while system is in Lockdown mode but configuring remote file share is not enabled.

NOTE The interfaces like OMSA, SysCfg, and USC can only check the settings but cannot modify the configurations.

The following table lists the functional and nonfunctional features, interfaces, and utilities that are affected by Lockdown mode:

NOTE Changing the boot order using iDRAC is not supported when Lockdown mode is enabled. However, boot-control option is available in vConsole menu, which has no effect when iDRAC is in Lockdown mode.

Table 1. Items affected by Lockdown modeThis table lists the impact of Lockdown mode on some of the features.
Disabled	Remains functional
Deleting Licenses DUP updates SCP import Reset to defaults OMSA/OMSS IPMI DRAC/LC DTK-Syscfg Redfish OpenManage Essentials BIOS (F2 settings become read-only) Group manager Select network cards	Power Operations - Power ON/OFF, Reset Power cap setting Power priority Identify devices (Chassis or PERC) Part replacement, Easy Restore, and system board replacement Running diagnostics Modular operations (FlexAddress or Remote-Assigned Address) Group Manager passcode All vendor tools that have direct access to the device (excludes selected NIC's) License export PERC PERC CLI DTK-RAIDCFG F2/Ctrl+R All Vendor tools that have direct access to the device NVMe DTK-RAIDCFG F2/Ctrl+R BOSS-S1 Marvell CLI F2/Ctrl+R ISM/OMSA settings (OS BMC enable, watchdog ping, OS name, OS version)

NOTE When lockdown mode is enabled, OpenID Connect login option is not displayed in iDRAC login page.