---
title: 'QuickTip: Disable cpu-microcode from loading on ESXi'
url: 'https://patrik.kernstock.net/blog/quicktip-disable-cpu-microcode-from-loading-on-esxi'
markdown: 'https://patrik.kernstock.net/blog/quicktip-disable-cpu-microcode-from-loading-on-esxi.md'
date: '2025-05-01'
description: 'Just a random quick-tip for labs: Disabling cpu-microcode for better CPU power efficiency – with trade-off being security. By default, ESXi will load the cpu-microcode module shipped with the installation, if it is newer and applicable than what BIOS provides. It is typically updated with regular ESXi updates. This can be disabled. The VIB installatio'
taxonomy:
  category:
    - VMware
    - vSphere
  tag:
    - cpu-microcode
    - ESX
    - Performance
    - QuickTip
    - 'Spectre & Meltdown'
---

# [QuickTip: Disable cpu-microcode from loading on ESXi](https://patrik.kernstock.net/blog/quicktip-disable-cpu-microcode-from-loading-on-esxi)

   May 1, 2025    2 min 

   [VMware](https://patrik.kernstock.net/category:VMware) [vSphere](https://patrik.kernstock.net/category:vSphere)    [cpu-microcode](https://patrik.kernstock.net/tag:cpu-microcode) [ESX](https://patrik.kernstock.net/tag:ESX) [Performance](https://patrik.kernstock.net/tag:Performance) [QuickTip](https://patrik.kernstock.net/tag:QuickTip) [Spectre & Meltdown](https://patrik.kernstock.net/tag:Spectre%20%26%20Meltdown)  

 Note

This article is more than 1 year(s) old – information may be outdated.

 ![QuickTip: Disable cpu-microcode from loading on ESXi](https://patrik.kernstock.net/images/c/p/u/-/m/cpu-microcode-disable-perf-illustration-0fc39c42.jpg?g-b3a1b014 "QuickTip: Disable cpu-microcode from loading on ESXi") 

Just a random quick-tip for labs: Disabling cpu-microcode for better CPU power efficiency – with trade-off being security. By default, ESXi will load the `cpu-microcode` module shipped with the installation, if it is newer and applicable than what BIOS provides. It is typically updated with regular ESXi updates. This can be disabled.

The VIB installation is like:

```plaintext
[root@esxi01:~] vmware -vl
VMware ESXi 8.0.3 build-24674464
VMware ESXi 8.0 Update 3

[root@esxi01:~] esxcli software vib list | grep microcode
cpu-microcode                  8.0.3-0.70.24674464                   VMware  VMwareCertified   2025-04-29    host
```

If some performance wants to be regained, at the severe cost of security, `cpu-microcode` could be removed from the installation. Altought, this is tedious on a longer run and will be re-installed during each update. Hence preventing it from loading in the first place is the best way.

To check the current settings (which are also default as of 8.0 U3):

```plaintext
[root@esxi01:~] esxcli system settings kernel list -o microcodeUpdate
Name             Type  Configured  Runtime  Default  Description
---------------  ----  ----------  -------  -------  -----------
microcodeUpdate  Bool  TRUE        FALSE    TRUE     Update microcode from boot module if available

[root@esxi01:~] esxcli system settings kernel list -o microcodeUpdateForce
Name                  Type  Configured  Runtime  Default  Description
--------------------  ----  ----------  -------  -------  -----------
microcodeUpdateForce  Bool  FALSE       FALSE    FALSE    Disable check that microcode update is newer than installed microcode and that both are released versions
```

To disable it:

```plaintext
esxcli system settings kernel set -s microcodeUpdate -v FALSE
esxcli system settings kernel set -s microcodeUpdateForce -v FALSE
```

Then it will look like:

```plaintext
[root@esxi01:~] esxcli system settings kernel list -o microcodeUpdate
Name             Type  Configured  Runtime  Default  Description
---------------  ----  ----------  -------  -------  -----------
microcodeUpdate  Bool  FALSE       FALSE    TRUE     Update microcode from boot module if available
```

During boot time, it can then also be seen that microcode is not loaded anymore:

```plaintext
[root@esxi01:~] zcat /var/log/boot.gz | grep -i microcode
TSC: 393954 cpu0:1)BootConfig: 783: microcodeUpdate = FALSE (0)
TSC: 395993 cpu0:1)BootConfig: 783: microcodeUpdateForce = FALSE (0)
TSC: 398297 cpu0:1)BootConfig: 783: skipMicrocodeCompatCheck = FALSE (0)
0:00:00:00.000 cpu0:1)MicrocodeUpdate: 117: Early microcode patching disabled by boot option
0:00:00:00.000 cpu0:1)MicrocodeUpdate: 257: Microcode Update Signature (MSR 0x8b): 0x0b00003e; Platform ID (MSR 0x17): 0x0
0:00:00:05.570 cpu0:2097152)VMK init (95/192): MicrocodeUpdate_LateCleanup
0:00:00:05.571 cpu0:2097152)SysInitTable: 113: Finished sysInit step: MicrocodeUpdate_LateCleanup in 1023 us.
```

In this case, the `cpu-microcode` from BIOS will be loaded and used.

##     Comments    

 Sort by: 

Loading comments...

---

## Navigation

- Parent: [Blog](https://patrik.kernstock.net/index.md)
- Next: [vCloud: "Failed to Start" after changing "Public Addresses" for API](https://patrik.kernstock.net/blog/vcloud-failed-to-start-after-changing-public-addresses-for-api.md)