Integrated Dell Remote Access Controller 9 User's Guide

PDF

System Configuration Lockdown mode

System Configuration Lockdown mode helps in preventing unintended changes after a system is provisioned. Lockdown mode is applicable to both configuration and firmware updates. When the system is locked down, any attempt to change the system configuration is blocked. If any attempts are made to change the critical system settings, an error message is displayed. Enabling System lockdown mode blocks the firmware update of third-party I/O cards using the vendor tools.

System Lockdown mode is only available for Enterprise licensed customers.

In the 4.40.00.00 release, System lockdown functionality is extended to NICs also.

NOTE: Enhanced Lockdown for NICs only includes firmware lockdown to prevent firmware updates. Configuration (x-UEFI) lockdown is not supported.

NOTE:After the System Lockdown mode is enabled, you cannot change any configuration settings. System settings fields are disabled.

Lockdown mode can be enabled or disabled using the following interfaces:

iDRAC web interface
RACADM
WSMan
System Configuration Profile (SCP)
Redfish
Using F2 during POST and selecting iDRAC Settings
Factory System Erase

NOTE:To enable Lockdown mode, you must have an iDRAC Enterprise or Datacenter license, and Control and Configure system privileges.

NOTE:You may be able to access vMedia while system is in the Lockdown mode but configuring remote file share is not enabled.

NOTE:The interfaces such as OMSA, SysCfg, and USC can only check the settings but cannot modify the configurations.

NOTE:When the Lockdown mode is enabled, you cannot configure any alert settings. However, you can trigger a test email.

The following table lists the functional and nonfunctional features, interfaces, and utilities that are affected by Lockdown mode:

NOTE:Changing the boot order using iDRAC is not supported when Lockdown mode is enabled. However, a boot-control option is available in the vConsole menu, which has no effect when iDRAC is in the Lockdown mode.

Table 1. Items affected by Lockdown modeThis table lists the impact of Lockdown mode on some of the features.
Disabled	Remains functional
Deleting Licenses DUP updates SCP import Reset to defaults OMSA/OMSS IPMI DRAC/LC DTK-Syscfg Redfish OpenManage Essentials BIOS (F2 settings become read-only) Group manager Select network cards. iLKM/SEKM	Power Operations - Power ON/OFF, Reset Power cap setting Power priority Identify devices (Chassis or PERC) Part replacement, Easy Restore, and System Board replacement Running diagnostics Modular operations (FlexAddress or Remote-Assigned Address) Group Manager passcode All vendor tools that have direct access to the device (excludes selected NICs) License export PERC PERC CLI DTK-RAIDCFG F2/Ctrl+R All Vendor tools that have direct access to the device. NVMe DTK-RAIDCFG F2/Ctrl+R BOSS-S1 Marvell CLI F2/Ctrl+R ISM/OMSA settings (OS BMC enable, watchdog ping, operating system name, operating system version)

NOTE:When lockdown mode is enabled, the OpenID Connect login option is not displayed in the iDRAC login page.