Block SID lockdown: what error 0x4286 means
Sometimes a drive refuses to erase not because it's broken, but because the BIOS deliberately locked it. That's Block SID lockdown.
You issue a Sanitize or Format command to an NVMe drive and get back status 0x4286 — Access Denied. The drive isn't faulty. The motherboard has applied a TCG Block SID lock, which blocks erasure commands until the lock is lifted.
What is Block SID?
Block SID is a TCG-defined feature that lets a platform lock down storage devices so they can't be erased or repurposed without authorisation. It's a theft-deterrence feature — the idea being that a stolen laptop's drive can't simply be wiped and resold.
Why BIOSes enable it
Manufacturers — Lenovo is the most common — ship some systems with Block SID enabled by default. On those machines, the BIOS issues the lock at every boot, so the drive rejects Sanitize, Format, and similar commands with 0x4286.
How to recognise it
Block SID is notoriously hard to detect from outside. Tools that query the drive's OPAL state (sedutil --query) report Locked=N, so it looks like there's nothing wrong — until the erase command itself fails with 0x4286. The failed erasure is often the only signal.
What you can do about it
- Disable Block SID in the BIOS — if the machine is yours, this is the clean fix. Then power-cycle and re-run the erase.
- Move the drive to a system without the lock and erase it there.
- Physical destruction — where you can't lift the lock (e.g. a decommissioned asset with a locked BIOS), the drive must be destroyed instead.
How tScrub handles it
tScrub treats a 0x4286 Access Denied as a BLOCKED drive — distinct from a failed or physically damaged drive. It flags the drive for physical destruction rather than silently marking it erased, so the report honestly reflects that the data was never wiped. That's the difference between an audit you pass and one you don't.
FAQ
Is a Block SID drive lost?
Not necessarily. If you control the hardware, disable Block SID in the BIOS and the erase will go through. Only when the lock can't be lifted does the drive need destruction.
Does Block SID affect hard drives too?
It's most commonly seen on NVMe drives, but the concept applies to any TCG-compliant device. The 0x4286 status specifically shows up on NVMe erasure attempts.