A drive lock a re-image could not clear
A cold boot triggered an ATA drive lock after a BIOS flash. A plain re-image would not touch it. Here is what did.
One of the OptiPlex 7070s in our refurb queue locked itself out cold, right after routine BIOS work.
Symptom: on a cold power-up, the machine stopped at a Dell drive password prompt before Windows ever loaded. It had worked fine minutes earlier. We had not touched the drive.
The diagnosis
The obvious fix for a machine that will not boot cleanly is to re-image it. We did. Windows 11 installed and sysprepped without a single error. The machine looked recovered.
It locked again on the next cold power-cycle.
That is the tell that this was never a software problem. An ATA drive lock is set at the firmware level of the drive itself, not in Windows, not in the partition table, not anywhere an operating system install touches. A re-image wipes and rewrites everything the OS can see and leaves the lock completely untouched, because the lock was never inside that layer to begin with. You can reinstall Windows a hundred times and the drive will keep asking for a password on every cold boot, because nothing about a re-image reaches below the OS to the drive’s own firmware.
What actually happened
The machine had gone through a Dell Command Configure BIOS flash as part of the standard refurb pass. That flash reset a stored auto-unlock setting the drive was relying on to skip the password prompt silently on every boot. Once that setting was gone, the drive reverted to asking, and it was going to keep asking until something addressed the drive directly.
The fix
| Step | Detail |
|---|---|
| Wrong fix (confirmed not to work) | Full re-image, Windows 11, sysprepped clean. Lock reappeared on the next cold boot. |
| Actual fix, this unit | Swapped in a new SSD entirely. The lock lives in the old drive’s own controller, so pulling that drive out of the build removes it at the root. |
| Alternative, when you would rather keep the original drive | A drive-level ATA Secure Erase, NVMe crypto-erase, or PSID revert, invoked below the OS, then re-image. Not what we did on this unit, but the documented route when swapping the drive is not the preferred fix. |
The unit was closed out and marked ready to sell once the new drive was in place. A re-image on top of a drive that was never locked in the first place is a different, much simpler problem, and it held.
What this means going forward
A BIOS flash is a routine step in getting these machines ready, and on a drive that depends on a stored auto-unlock setting, that same routine step can trigger a lock the next time the machine goes cold. Whether the fix is a drive swap or a secure erase in place, a plain re-image on top of a locked drive will not touch it, and knowing that before you spend an afternoon re-imaging the same machine twice is worth writing down.
The lesson
Not every failure that looks like a software problem is one. When a fix that should work does not hold, the question worth asking is not “did I do the re-image correctly,” it is “was the OS ever where this problem actually lived.” Some failures sit below the layer a re-image can reach, and the fix has to match where the fault actually is.