diff --git a/content/bootenvs/discovery.yml b/content/bootenvs/discovery.yml
index 6b19281d..e61370c7 100644
--- a/content/bootenvs/discovery.yml
+++ b/content/bootenvs/discovery.yml
@@ -78,9 +78,9 @@ Templates:
     Path: "default.ipxe"
     Contents: |
       #!ipxe
-      chain {{.ProvisionerURL}}/${netX/mac}.ipxe && exit || goto chainip
+      chain {{.ProvisionerURL}}/${netX/mac}.ipxe && exit 1 || goto chainip
       :chainip
-      chain {{.ProvisionerURL}}/${netX/ip}.ipxe && exit || goto sledgehammer
+      chain {{.ProvisionerURL}}/${netX/ip}.ipxe && exit 1 || goto sledgehammer
       :sledgehammer
       chain {{.ProvisionerURL}}/${builtin/buildarch}.ipxe
   - Name: "ipxe-i386"
diff --git a/content/stages/lock-machine.yaml b/content/stages/lock-machine.yaml
new file mode 100644
index 00000000..0011b940
--- /dev/null
+++ b/content/stages/lock-machine.yaml
@@ -0,0 +1,9 @@
+---
+Description: "Stage to lock the machine"
+Meta:
+  color: "yellow"
+  icon: "key"
+Name: "lock-machine"
+Reboot: false
+Tasks:
+  - "lock-machine"
diff --git a/content/tasks/lock-machine.yaml b/content/tasks/lock-machine.yaml
new file mode 100644
index 00000000..416b262e
--- /dev/null
+++ b/content/tasks/lock-machine.yaml
@@ -0,0 +1,20 @@
+---
+Name: "lock-machine"
+Description: "Lock the machine to prevent further user changes"
+Documentation: |
+  Sets Field: Lock
+
+  Lock the machine so users can not alter the machine.
+  Current tasks and machine actions will continue to run.
+Templates:
+  - Name: "lock-me"
+    Contents: |
+      #!/usr/bin/env bash
+      {{ template "setup.tmpl" . }}
+      echo "Running drpcli command to lock machine"
+      drpcli machines update {{.Machine.UUID}} '{ "Locked": true }'
+Meta:
+  icon: "key"
+  color: "blue"
+  title: "Digital Rebar Community Content"
+  feature-flags: "sane-exit-codes"