OEM Unlocking is a highly sensitive developer setting hidden within the Android operating system. When enabled, it allows the device’s bootloader to be unlocked via fastboot commands, paving the way for flashing custom recovery images, installing custom ROMs, or achieving root access. In a secure, managed enterprise environment, allowing users to enable OEM Unlocking is a critical security vulnerability. An unlocked bootloader completely compromises the device’s secure boot chain, invalidates Android Verified Boot (AVB), and allows a malicious actor with physical access to bypass all on-device encryption and MDM restrictions.
This guide explains how to completely disable and lock the OEM Unlocking toggle system-wide on an Android device to ensure the bootloader remains permanently secured.
Disable OEM Unlocking in Developer Options
To secure the bootloader, we must access the hidden Developer Options menu, explicitly disable the capability, and then ideally revoke access to the Developer menu entirely to prevent tampering.
- Open the main Settings app on your Android smartphone.
- Scroll down to the bottom and tap on About phone.
- Scroll down to find the Build number. Tap on “Build number” exactly seven times in rapid succession to enable Developer Options. (You may be prompted to enter your PIN).
- Navigate back to the main Settings menu and tap on System (or scroll to the bottom).
- Tap on Developer options.
- Locate the toggle switch labeled OEM unlocking. If it is turned on, toggle it to the Off (grey) position.
- (Optional but highly recommended): Scroll to the very top of the Developer Options menu and toggle the master switch to the Off position to completely hide the menu again.
Verify the System State
By disabling this specific flag in the settings, the Android OS writes a secure variable to a persistent partition (often the FRP partition) instructing the bootloader to reject any fastboot unlocking commands.
To verify the lockdown is active, power off the device completely. Hold down the Volume Down and Power buttons simultaneously to boot into the bootloader/fastboot mode. Connect the device to a PC with the Android SDK Platform Tools installed. Open a command prompt and type fastboot flashing unlock (or fastboot oem unlock on older devices). The bootloader will immediately reject the command, returning an error stating “Flashing Unlock is not allowed” or similar. The device’s hardware trust chain is now securely maintained.