diff --git a/app/controllers/admin/clients_controller.rb b/app/controllers/admin/clients_controller.rb
index 4ef5a44..db478ff 100644
--- a/app/controllers/admin/clients_controller.rb
+++ b/app/controllers/admin/clients_controller.rb
@@ -1,85 +1,107 @@
 class Admin::ClientsController < Admin::BaseController
-  before_action :fetch_client, only: [:show, :jobs, :logs, :stats,
-                                      :configuration, :disable, :revoke]
+  before_action :fetch_client, only: [:show, :jobs, :logs, :stats, :configuration,
+                                      :disable, :revoke, :block, :unblock]
   before_action :fetch_logs, only: [:logs]
 
   # Shows all available clients
   #
   # GET /admin/clients
   def index
     @clients = Client.includes(:jobs).all
     @client_ids = @clients.map(&:id)
     fetch_jobs_info
   end
 
   # Shows a specific client
   #
   # GET /admin/clients/1
   def show
     if !@client.host.present?
       flash[:alert] = 'Client not configured through Archiving'
       return redirect_to admin_clients_path
     end
 
     get_charts
   end
 
   # GET /admin/clients/1/jobs
   def jobs
     @jobs = @client.recent_jobs.page(params[:page])
   end
 
   # GET /admin/clients/1/logs
   def logs
   end
 
   # GET /admin/clients/1/stats
   # POST /admin/clients/1/stats
   def stats
     get_charts
   end
 
   # GET /admin/clients/1/configuration
   def configuration
   end
 
   # POST /admin/clients/1/disable
   def disable
     if @client.host.disable_jobs_and_update
       flash[:success] = 'Client disabled'
     else
       flash[:error] = 'Something went wrong, try again later'
     end
 
     redirect_to admin_client_path(@client)
   end
 
+  # POST /admin/clients/1/block
+  def block
+    if @client.host.disable_jobs_and_lock
+      flash[:success] = 'Client is disabled and locked'
+    else
+      flash[:error] = 'Something went wrong, try again'
+    end
+
+    redirect_to admin_client_path(@client)
+  end
+
+  # POST /admin/clients/1/unblock
+  def unblock
+    if @client.host.unblock
+      flash[:success] = 'Client can know be configured by users'
+    else
+      flash[:error] = 'Client is still locked'
+    end
+
+    redirect_to admin_client_path(@client)
+  end
+
   # DELETE /admin/clients/1/revoke
   def revoke
     if @client.host.remove_from_bacula(true)
       flash[:success] = 'Client removed. It will be visible to until its jobs get cleaned up'
     else
       flash[:error] = 'Something went wrong, try again later'
     end
 
     redirect_to admin_clients_path
   end
 
   private
 
   # Fetches the client based on the given id
   def fetch_client
     @client = Client.find(params[:id])
     @client_ids = [@client.id]
   end
 
   def fetch_jobs_info
     @stats = JobStats.new
   end
 
   def get_charts
     days_ago = params.fetch(:days_back, 7).to_i rescue 7
     @job_status = ChartGenerator.job_statuses(@client_ids, days_ago)
     @job_stats = ChartGenerator.job_stats(@client_ids, days_ago - 1)
   end
 end
diff --git a/app/helpers/hosts_helper.rb b/app/helpers/hosts_helper.rb
index ff2f1ac..965bcd2 100644
--- a/app/helpers/hosts_helper.rb
+++ b/app/helpers/hosts_helper.rb
@@ -1,27 +1,29 @@
 module HostsHelper
   # Returns an html span with the host's status
   def host_status_label(host)
     return unless host
 
     case
     when host.pending?
       klass = "default"
     when host.configured?
       klass = "warning"
     when host.dispatched?
       klass = "info"
     when host.deployed?
       klass = "success"
     when host.updated?
       klass = "info"
     when host.redispatched?
       klass = "primary"
     when host.for_removal?
       klass = "danger"
     when host.inactive?
       klass = "warning"
+    when host.blocked?
+      klass = "warning"
     end
 
     content_tag(:span, class: "label label-#{klass}") { host.human_status_name.upcase }
   end
 end
diff --git a/app/models/host.rb b/app/models/host.rb
index 73a79f6..0943697 100644
--- a/app/models/host.rb
+++ b/app/models/host.rb
@@ -1,264 +1,281 @@
 # The bacula database must be independent from all of our application logic.
 # For this reason we have Host which is the application equivalent of a Bacula Client.
 #
 # A host is being created from our application. When it receives all the configuration
 # which is required it gets dispatched to bacula through some configuration files. After
 # that, a client with the exact same config is generated by bacula.
 class Host < ActiveRecord::Base
   include Configuration::Host
 
   STATUSES = {
     pending: 0,
     configured: 1,
     dispatched: 2,
     deployed: 3,
     updated: 4,
     redispatched: 5,
     for_removal: 6,
-    inactive: 7
+    inactive: 7,
+    blocked: 8
   }
 
   has_many :ownerships
   has_many :users, through: :ownerships, inverse_of: :hosts
 
   belongs_to :client, class_name: :Client, foreign_key: :name, primary_key: :name
   belongs_to :verifier, class_name: :User, foreign_key: :verifier_id, primary_key: :id
 
   has_many :filesets, dependent: :destroy
   has_many :job_templates, dependent: :destroy
   has_many :schedules, dependent: :destroy
 
   validates :file_retention, :job_retention,
     :port, :password, presence: true
   validates :port, numericality: true
 
   validates :fqdn, presence: true, uniqueness: true
 
   validate :fqdn_format
 
   scope :not_baculized, -> {
     joins("left join Client on Client.Name = hosts.name").where(Client: { Name: nil })
   }
 
   scope :in_bacula, -> {
     where(
       status: STATUSES.select { |k,_|
         [:deployed, :updated, :redispatched, :for_removal].include? k
       }.values
     )
   }
 
   scope :unverified, -> { where(verified: false) }
 
   before_validation :set_retention, :unset_baculized, :sanitize_name
 
   state_machine :status, initial: :pending do
     STATUSES.each do |status_name, value|
       state status_name, value: value
     end
 
     after_transition [:dispatched, :redispatched, :configured, :updated] => :deployed do |host|
       host.job_templates.enabled.
         update_all(baculized: true, baculized_at: Time.now, updated_at: Time.now)
     end
 
     event :add_configuration do
       transition [:pending, :dispatched, :inactive] => :configured
     end
 
     event :dispatch do
       transition :configured => :dispatched
     end
 
     event :redispatch do
       transition :updated => :redispatched
     end
 
     event :set_deployed do
       transition [:dispatched, :redispatched, :configured, :updated] => :deployed
     end
 
     event :change_deployed_config do
       transition [:deployed, :redispatched, :for_removal] => :updated
     end
 
     event :mark_for_removal do
       transition [:dispatched, :deployed, :updated, :redispatched] => :for_removal
     end
 
     event :set_inactive do
       transition [:deployed, :dispatched, :updated, :redispatched] => :inactive
     end
 
     event :disable do
       transition all => :pending
     end
+
+    event :block do
+      transition all - [:blocked] => :blocked
+    end
+
+    event :unblock do
+      transition :blocked => :pending
+    end
   end
 
   # Determines if a host has enabled jobs in order to be dispatched to Bacula
   #
   # @return [Boolean]
   def bacula_ready?
     job_templates.enabled.any?
   end
 
   # Shows the host's auto_prune setting
   def auto_prune_human
     client_settings[:autoprune]
   end
 
   # Uploads the host's config to bacula
   # Reloads bacula server
   #
   # It updates the host's status accordingly
   def dispatch_to_bacula
     return false if not needs_dispatch?
     bacula_handler.deploy_config
   end
 
   # Removes a Host from bacula configuration.
   # Reloads bacula server
   #
   # If all go well it changes the host's status and returns true
   #
   # @param force[Boolean] forces removal
   def remove_from_bacula(force=false)
     return false if not (force || needs_revoke?)
     bacula_handler.undeploy_config
   end
 
   # Restores a host's backup to a preselected location
   #
   # @param fileset_id[Integer] the desired fileset
   # @param location[String] the desired restore location
   # @param restore_point[Datetime] the desired restore_point datetime
   def restore(file_set_id, location, restore_point=nil)
     return false if not restorable?
     job_ids = client.get_job_ids(file_set_id, restore_point)
     file_set_name = FileSet.find(file_set_id).file_set
     bacula_handler.restore(job_ids, file_set_name, restore_point, location)
   end
 
   # Runs the given backup job ASAP
   def backup_now(job_name)
     bacula_handler.backup_now(job_name)
   end
 
   # Disables all jobs and sends the configuration to Bacula
   def disable_jobs_and_update
     job_templates.update_all(enabled: false)
     bacula_handler.deploy_config
   end
 
+  # Disables all jobs if needed and then locks the host
+  def disable_jobs_and_lock
+    return false if can_set_inactive? && !disable_jobs_and_update
+    block
+  end
+
   # Determinex weather a host:
   #
   # * has all it takes to be deployed but
   # * the config is not yet sent to bacula
   #
   # @return [Boolean]
   def needs_dispatch?
     verified? && (can_dispatch? || can_redispatch?)
   end
 
   # Determines weather a host is marked for removal
   #
   # @return [Boolean]
   def needs_revoke?
     for_removal?
   end
 
   # Handles the host's job changes by updating the host's status
   def recalculate
     add_configuration || change_deployed_config
   end
 
   # Fetches an info message concerning the host's deploy status
   def display_message
     if !verified?
       { message: 'Your host needs to be verified by an admin', severity: :alert }
     elsif pending?
       { message: 'client not configured yet', severity: :alert }
     elsif configured? || dispatched?
       { message: 'client not deployed to Bacula', severity: :alert }
     elsif updated? || redispatched?
       { message: 'client configuration changed, deploy needed', severity: :alert }
     elsif for_removal?
       { message: 'pending client configuration withdraw', severity: :error }
     elsif inactive?
       { message: 'client disabled', severity: :alert }
+    elsif blocked?
+      { message: 'client disabled by admin.', severity: :error }
     end
   end
 
   # Determines if a host can issue a restore job.
   #
   # @returns [Boolean] true if the host's client can issue a restore job
   def restorable?
     client.present? && client.is_backed_up?
   end
 
   # @return [User] the first of the host's users
   def first_user
     users.order('ownerships.created_at asc').first
   end
 
   # Marks the host as verified and sets the relevant metadata
   #
   # @param admin_verifier[Integer] the verifier's id
   def verify(admin_verifier)
     self.verified = true
     self.verifier_id = admin_verifier
     self.verified_at = Time.now
     save
   end
 
   # Determines if a host can be disabled or not.
   # Equivalent to is_deployed
   #
   # @return [Boolean]
   def can_be_disabled?
     dispatched? || deployed? || updated? || redispatched?
   end
 
   private
 
   # automatic setters
 
   def sanitize_name
     self.name = fqdn
   end
 
   # Sets the file and job retention according to the global settings
   def set_retention
     self.file_retention = client_settings[:file_retention]
     self.file_retention_period_type = client_settings[:file_retention_period_type]
     self.job_retention = client_settings[:job_retention]
     self.job_retention_period_type = client_settings[:job_retention_period_type]
   end
 
   def unset_baculized
     self.baculized = false if new_record?
     true
   end
 
   # validation
 
   def fqdn_format
     regex = /(?=^.{4,253}$)(^((?!-)[a-zA-Z0-9-]{1,63}(?<!-)\.)+[a-zA-Z]{2,63}$)/
     unless fqdn =~ regex
       self.errors.add(:fqdn)
     end
   end
 
   # Proxy object for handling bacula directives
   def bacula_handler
     BaculaHandler.new(self)
   end
 
   # Fetches and memoizes the general configuration settings for Clients
   #
   # @see ConfigurationSetting.current_client_settings
   # @return [Hash] containing the settings
   def client_settings
     @client_settings ||= ConfigurationSetting.current_client_settings
   end
 end
diff --git a/app/views/admin/clients/show.html.erb b/app/views/admin/clients/show.html.erb
index d94b8b3..fc79cd3 100644
--- a/app/views/admin/clients/show.html.erb
+++ b/app/views/admin/clients/show.html.erb
@@ -1,33 +1,46 @@
 <%= render partial: 'header' %>
 
 <div class="row right">
-  <% if !@client.host.inactive? %>
+  <% if @client.host.can_set_inactive? %>
     <%= link_to 'Disable client', disable_admin_client_path(@client), method: :post,
       data: { confirm: 'This will disable the client. Are you sure?' },
       class: "btn btn-warning", role: "button" %>
   <% end %>
+
+  <% if @client.host.can_block? %>
+    <%= link_to 'Lock client', block_admin_client_path(@client), method: :post,
+      data: { confirm: 'This will disable and lock the client. Are you sure?' },
+      class: "btn btn-warning", role: "button" %>
+  <% end %>
+
+  <% if @client.host.blocked? %>
+    <%= link_to 'Unlock client', unblock_admin_client_path(@client), method: :post,
+      data: { confirm: 'This will unlock the client. Are you sure?' },
+      class: "btn btn-warning", role: "button" %>
+  <% end %>
+
   <%= link_to 'Remove client', revoke_admin_client_path(@client), method: :delete,
     data: { confirm: 'This will REMOVE the client from Bacula. Are you sure?' },
     class: "btn btn-danger", role: "button" %>
 </div>
 
 
 <div class="row">
   <div class="col-xs-4">
     <h3>Client Details</h3>
   </div>
   <div class="col-xs-6">
     <h3>Bacula Jobs</h3>
   </div>
 </div>
 
 <div class="row">
   <%= render partial: 'client_details' %>
   <div class="col-xs-8">
     <div class="row">
       <% if @client.host %>
         <%= render partial: 'jobs' %>
       <% end %>
     </div>
   </div>
 </div>
diff --git a/config/routes.rb b/config/routes.rb
index 91eb988..90f83d0 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -1,82 +1,84 @@
 Rails.application.routes.draw do
   root 'application#index'
   post 'grnet' => 'application#grnet'
   get 'institutional' => 'application#institutional'
   match 'vima', to: 'application#vima', :via => [:get, :post]
   get 'logout' => 'application#logout'
 
   resources :clients, only: [:index, :show] do
     member do
       get :jobs
       get :logs
       get :stats
       post :stats
       get :users
       get :restore
       post :run_restore
     end
 
     collection do
       post :index
     end
   end
 
   resources :hosts, only: [:new, :create, :show, :edit, :update, :destroy] do
     member do
       post :submit_config
       post :disable
       delete :revoke
     end
 
     resources :jobs, only: [:new, :create, :show, :edit, :update, :destroy] do
       member do
         patch :toggle_enable
         post :backup_now
       end
     end
 
     resources :filesets, only: [:show, :new, :create, :destroy]
     resources :schedules, only: [:show, :new, :edit, :create, :update, :destroy]
   end
 
   namespace :admin do
     match '/', to: 'base#index', via: [:get, :post]
 
     get '/login' => 'base#login', as: :login
 
     resources :settings, only: [:index, :new, :create, :edit, :update] do
       member do
         delete :reset
       end
     end
 
     resources :clients, only: [:index, :show] do
       member do
         get :jobs
         get :logs
         get :stats
         post :stats
         get :configuration
         post :disable
+        post :block
+        post :unblock
         delete :revoke
       end
     end
 
     resources :hosts, only: [:show] do
       collection do
         get :unverified
       end
 
       member do
         post :verify
       end
     end
 
     resources :users, only: [:index, :new, :create, :show, :edit, :update] do
       member do
         patch :ban
         patch :unban
       end
     end
   end
 end
diff --git a/spec/models/host_spec.rb b/spec/models/host_spec.rb
index fb228d0..705e48a 100644
--- a/spec/models/host_spec.rb
+++ b/spec/models/host_spec.rb
@@ -1,210 +1,210 @@
 require 'spec_helper'
 
 describe Host do
   context 'validates' do
     it "presence of Password" do
         expect(Host.new).to have(1).errors_on(:password)
     end
 
     it 'numericality of :port' do
       expect(Host.new(port: :lala)).to have(2).errors_on(:port)
     end
 
     [:file_retention, :job_retention, :name].each do |field|
       it "#{field} is set automatically" do
         host = Host.new(fqdn: 'test')
         host.valid?
         expect(host.send(field)).to be_present
       end
     end
   end
 
   context 'when fqdn is invalid' do
     let(:host) { FactoryGirl.build(:host, fqdn: :lala) }
 
     it 'has errors' do
       expect(host).to have(1).errors_on(:fqdn)
     end
   end
 
   context 'name field' do
     let(:host) { FactoryGirl.create(:host, name: nil) }
     it 'is generated by the system' do
       expect(host.name).to be
     end
   end
 
   describe '#dispatch_to_bacula' do
     let(:configured_host) { FactoryGirl.create(:host, :configured) }
     let(:updated_host) { FactoryGirl.create(:host, :updated) }
 
     context 'for non verified hosts' do
       let(:unverified_host) { FactoryGirl.create(:host, :configured) }
 
       it 'returns false' do
         expect(unverified_host.dispatch_to_bacula).to eq(false)
       end
     end
 
     it 'calls BaculaHandler#deploy_config' do
       BaculaHandler.any_instance.should_receive(:deploy_config)
       configured_host.dispatch_to_bacula
     end
 
     context 'when the config does not reach bacula' do
       before do
         BaculaHandler.any_instance.should_receive(:send_config) { false }
       end
 
       it 'returns false' do
         expect(configured_host.dispatch_to_bacula).to eq(false)
       end
 
       it 'does not change the status of a configured host' do
         expect { configured_host.dispatch_to_bacula }.
           to_not change { configured_host.reload.status }
       end
 
       it 'does not change the status of an updated host' do
         expect { updated_host.dispatch_to_bacula }.
           to_not change { updated_host.reload.status }
       end
     end
 
     context 'when the config is sent to bacula' do
       before do
         BaculaHandler.any_instance.should_receive(:send_config) { true }
       end
 
       context 'and bacula gets reloaded' do
         before do
           BaculaHandler.any_instance.should_receive(:reload_bacula) { true }
         end
 
         it 'makes the configured host deployed' do
           configured_host.dispatch_to_bacula
           expect(configured_host.reload).to be_deployed
         end
 
         it 'makes the updated host deployed' do
           updated_host.dispatch_to_bacula
           expect(updated_host.reload).to be_deployed
         end
       end
 
       context 'but bacula fails to reload' do
         before do
           BaculaHandler.any_instance.should_receive(:reload_bacula) { false }
         end
 
         it 'makes the configured host dispatcheda' do
           configured_host.dispatch_to_bacula
           expect(configured_host.reload).to be_dispatched
         end
 
         it 'makes the updated host redispatched' do
           updated_host.dispatch_to_bacula
           expect(updated_host.reload).to be_redispatched
         end
       end
     end
   end
 
   describe '#remove_from_bacula' do
     let(:host) { FactoryGirl.create(:host, status: Host::STATUSES[:for_removal]) }
 
     context 'when the config is NOT removed from bacula' do
       before { BaculaHandler.any_instance.should_receive(:remove_config) { false } }
 
       it 'returns false' do
         expect(host.remove_from_bacula).to eq(false)
       end
 
       it 'does not alter the host\'s status' do
         expect { host.remove_from_bacula }.
           to_not change { host.reload.status }
       end
     end
 
     context 'when the config is removed from bacula' do
       before { BaculaHandler.any_instance.should_receive(:remove_config) { true } }
 
       context 'and bacula gets reloaded' do
         before { BaculaHandler.any_instance.should_receive(:reload_bacula) { true } }
 
         it 'returns true' do
           expect(host.remove_from_bacula).to eq(true)
         end
 
         it 'changes the host\'s status to pending' do
           expect { host.remove_from_bacula }.
             to change { host.reload.human_status_name }.from('for removal').to('pending')
         end
       end
     end
   end
 
   describe '#recalculate' do
     let(:host) { FactoryGirl.create(:host, :with_enabled_jobs) }
 
-    [:configured, :updated].each do |status|
+    [:configured, :updated, :blocked].each do |status|
       context "a #{status} host" do
         before { host.update_column(:status, Host::STATUSES[status]) }
 
         it "stays #{status}" do
           expect { host.recalculate }.to_not change { host.reload.status }
         end
       end
     end
 
     [:pending, :dispatched, :inactive].each do |status|
       context "a #{status} host" do
         before { host.update_column(:status, Host::STATUSES[status]) }
 
         it 'becomes configured' do
           expect { host.recalculate }.
             to change { host.reload.human_status_name }.
             from(host.human_status_name).to('configured')
         end
       end
     end
 
     context 'a dispatched host' do
       before { host.update_column(:status, Host::STATUSES[:dispatched]) }
 
       it 'becomes configured' do
         expect { host.recalculate }.
           to change { host.reload.human_status_name }.
           from('dispatched').to('configured')
       end
     end
 
     [:deployed, :redispatched, :for_removal].each do |status|
       context "a #{status} host" do
         before { host.update_column(:status, Host::STATUSES[status]) }
 
         it 'becomes updated' do
           expect { host.recalculate }.
             to change { host.reload.human_status_name }.
             from(host.human_status_name).to('updated')
         end
       end
     end
   end
 
   describe '#verify' do
     let!(:host) { FactoryGirl.create(:host, verified: false) }
     let(:admin) { FactoryGirl.create(:user, :admin) }
 
     it 'verifies host' do
       host.verify(admin.id)
       expect(host).to be_verified
     end
 
     it 'sets the verification credentials' do
       host.verify(admin.id)
       expect(host.verifier_id).to eq(admin.id)
       expect(host.verified_at).not_to be nil
     end
   end
 end