I'm not familiar with that model of laptop but you should be able to put a BIOS/UEFI admin password that will not allow changes but still allow the laptop to be booted although that's not going to help with the "already affected" systems. You can also put a master password (NOT boot password) on the HDD before hand so the student can't.
It is also possible that he put a boot password on the HDDs and if you can get into the BIOS may be able to reset using a master password if set.
For the record: I have had NO luck in removing master passwords from the HDDS I have tried.
It is also possible that he put a boot password on the HDDs and if you can get into the BIOS may be able to reset using a master password if set.
For the record: I have had NO luck in removing master passwords from the HDDS I have tried.