Managed Object Browser (MOB): Access, Security & Troubleshooting Guide

If you have ever been stuck with a frozen task in vCenter or needed to find a specific Managed Object Reference ID (MoRef ID) for a script, you know the graphical user interface (GUI) doesn’t always have the answers. When the polished menus of the vSphere Client reach their limits, experienced administrators turn to the Managed Object Browser.

While it might look like a relic from the early 2000s, the Managed Object Browser (often referred to simply as the MOB) is one of the most powerful diagnostic utilities in your VMware toolkit. It offers a raw, unfiltered view of the vSphere API, allowing you to interact directly with the objects that make up your virtual environment.

In this guide, we will break down exactly what the Managed Object Browser is, how to access it on different versions of ESXi and vCenter, and how to use it safely for advanced troubleshooting.

What Is the Managed Object Browser?

The Managed Object Browser is a web-based server application built directly into ESXi hosts and vCenter Server systems. Think of it as a graphical interface for the vSphere API.

In the VMware infrastructure, everything is an object. A virtual machine is an object. A datastore is an object. Even the alarm system is an object. The VMware Managed Object Browser allows you to navigate through the hierarchy of these live objects. It lets you view their properties, modify configurations, and invoke methods (perform actions) directly on the server.

For developers and automation engineers, the MOB is essential for understanding the object model. For administrators, it is a “break glass in case of emergency” tool used to perform tasks that might glitch in the standard UI, such as finishing a hung task or verifying certificate details.

When we access the MOB, we are looking at the server-side objects that the vSphere API manages.

• Properties: These are data points about an object (e.g., a VM’s name, power state, or IP address).
• Methods: These are actions you can take (e.g., PowerOnVM, Destroy, or RebootGuest).

Accessing the Managed Object Browser

Accessing the MOB depends heavily on which version of vSphere you are running. In older versions, it was enabled by default. In modern environments (vSphere 6.x, 7.x, 8.x, and 9.0), the MOB is disabled by default to improve security posture.

Here is how to access and enable the MOB across different platforms.

1. Accessing the ESXi Managed Object Browser

To access the Managed Object Browser ESXi interface, you typically use a web browser to navigate to the host’s IP address or FQDN.

Standard URL:
https://<ESXi_Host_IP_or_FQDN>/mob

However, if you are running the Managed Object Browser ESXi 6.5 or later, you will likely encounter a 503 Service Unavailable error. You must enable it first.

How to Enable Managed Object Browser on ESXi:
You can do this via the Host Client or the command line.

• Via UI: Go to Host > Manage > System > Advanced Settings. Search for Config.HostAgent.plugins.solo.enableMob and set the value to true.
• Via SSH: Connect to the host and run the following command:
  vim-cmd hostsvc/advopt/update Config.HostAgent.plugins.solo.enableMob bool true

2. Accessing the vCenter Managed Object Browser

The vCenter Managed Object Browser provides a centralized view of the entire inventory.

Standard URL:
https://<vCenter_Server_IP_or_FQDN>/mob

Just like the host version, the Managed Object Browser vCenter interface is disabled by default in newer versions.

How to Enable the MOB on vCenter:
For Managed Object Browser vCenter 6.5, 7.x, and 8.x, you generally need to modify the vpxd.cfg file.

1. SSH into the vCenter Server Appliance (VCSA).
2. Back up the config file: cp /etc/vmware-vpx/vpxd.cfg /var/core/vpxd.cfg
3. Edit the file: vi /etc/vmware-vpx/vpxd.cfg
4. Add or modify the <enableDebugBrowse> entry within the <vpxd> section:
   <vpxd>
     …
     <enableDebugBrowse>true</enableDebugBrowse>
     …
   </vpxd>
5. Restart the vpxd service: service-control –restart vmware-vpxd

Note: Always remember to disable the Managed Object Browser vCenter settings after you finish your troubleshooting session.

MOB Configuration Settings

Platform	Configuration Key / File	Command / Action
ESXi 6.x – 8.x	Config.HostAgent.plugins.solo.enableMob	Set to true via Advanced System Settings
vCenter 6.x – 9.x	/etc/vmware-vpx/vpxd.cfg	Add <enableDebugBrowse>true</enableDebugBrowse>
SSH Command (ESXi)	vim-cmd	vim-cmd hostsvc/advopt/update

Using the MOB for Troubleshooting

Once you have successfully logged into the Managed Object Browser, you can perform advanced troubleshooting.

Here are common scenarios where the MOB saves the day.

Finding Managed Object Reference IDs (MoRefs)

Automation tools often require the specific ID of an object, not just its name.

1. Click content (the ServiceInstance).
2. Click rootFolder.
3. Navigate through childEntity (Datacenters) -> vmFolder -> childEntity.
4. You will see a list of VMs with IDs like vm-102 or vm-445. These are the MoRef IDs you need for your scripts.

Deleting a “Zombie” Task

Sometimes a task (like a snapshot removal or VM migration) gets stuck in the “In Progress” state and cannot be cancelled in the UI.

1. In the Managed Object Browser, navigate to the TaskManager (found under content > taskManager).
2. Click on recentTask.
3. Locate the ID of the stuck task (e.g., task-293).
4. Click the task ID link.
5. At the bottom of the page, click the link for the void method (often CancelTask isn’t directly exposed here, but you can inspect the info property to find the task object and then invoke CancelTask if available on that specific object page).

Inspecting Certificates

You can navigate the MOB vCenter certificate paths to view the exact certificate chain the vSphere API is presenting, which is helpful when debugging SSL handshake errors in third-party backup tools.

Best Practices and Security Considerations

While the MOB is useful, it is also a significant security risk. It provides a web-based interface that can alter the configuration of your hosts and virtual machines. If an attacker gains access to the MOB, they have full control over the object model.

1. The “Enable-Use-Disable” Workflow

The golden rule is simple: Disable MOB access immediately after use. Do not leave it running.

• Disable Managed Object Browser 6: If you are still running vSphere 6.x, check your hosts. It might be enabled if you upgraded from version 5.x.
• Disable VMware Managed Object Browser: Make this part of your standard hardening checklist.

2. How to Disable Managed Object Browser

To disable the Managed Object Browser on ESXi:

• Navigate back to Advanced System Settings.
• Set Config.HostAgent.plugins.solo.enableMob to false.

To disable Managed Object Browser vCenter configurations:

• Edit the vpxd.cfg file again.
• Change <enableDebugBrowse>true</enableDebugBrowse> to false.
• Restart the service.

3. Verification

You can verify that you successfully disabled Managed Object Browser access by attempting to navigate to the URL. You should receive a “503 Service Unavailable” message (on ESXi) or a “404 Not Found” (on some vCenter configurations).

Conclusion

The Managed Object Browser is still one of the best tools to discover how our VMware environment really works. If you are searching for a particular MOB ESXi property or want to know how to view MOB ESX logs when the client is off, then the MOB is your go-to utility.

Don’t forget, great power comes with great responsibilities. As always, follow best practices and be secure. Simply turn on the MOB to troubleshoot, and then immediately turn it off. By treating the MOB as a diagnostic bridge to be used with caution, rather than an always-on front door into our environment, we can stay secure while still troubleshooting difficult issues.

FAQs