BIOS passwords and management locks: checks before you buy

Why a lock decides what a unit is worth

A business laptop can be in perfect condition and still be close to unsellable. If it has a firmware password nobody knows, or it is still registered to the company that owned it, the next owner may not be able to install an operating system, change basic settings or even get past the first setup screen. For a buyer of lots, locks matter as much as grades: a grade A unit with an active lock is often worth less than a grade C unit without one.

Most ex-corporate stock is cleared properly before it is sold. Disposal companies remove passwords, release devices from management systems and erase the drives. Some units still slip through, and the time to find out is before you agree a price, not when your customer cannot log in.

Firmware and drive passwords

The firmware settings screen, still widely called the BIOS, can carry several passwords. A supervisor or administrator password protects the settings themselves: without it you cannot change the boot order, turn features on or off, or restore the defaults. A power-on password stops the laptop starting at all. A hard drive password locks the drive itself, so it travels with the drive if you fit it to another machine.

On modern business laptops these passwords are stored so that removing the main battery or the small backup cell does not clear them. That is deliberate, and it is what makes them useful to the companies that set them. On many ThinkPad, EliteBook and Latitude models, a forgotten supervisor password means a manufacturer service route or a replacement motherboard, which on most units costs more than the machine is worth to a reseller.

Tracking and remote management

Some laptops carry tracking software built into the firmware. Absolute, formerly known as Computrace, is the best known. A company that subscribes can have it reinstall its agent even after the drive has been wiped. The firmware settings usually show its state, with wording such as enabled, disabled or permanently disabled. Only the subscriber, or Absolute itself, can release a device that is still active.

Intel vPro machines include Intel AMT, which lets an IT department manage a laptop over the network. AMT has its own password, set in a separate menu called MEBx. A machine whose AMT was configured by a previous owner is not necessarily a problem, but it should be unprovisioned, so the previous owner's settings do not follow it to your customer. Check that MEBx shows it as unconfigured, or that AMT is switched off.

Enrolment locks: Autopilot, MDM and Activation Lock

The locks that catch most buyers today are not in the firmware at all. A Windows laptop registered with Microsoft Autopilot is linked to its last owner's organisation through Microsoft's cloud services. Wipe the drive and reinstall Windows, and the first setup screen will still show that company's sign-in page, because the link is held by Microsoft, not on the laptop. Only the organisation, or the IT supplier acting for it, can remove the device from its Autopilot list.

Apple laptops have two equivalents. Activation Lock ties a Mac to the Apple Account of whoever turned on Find My, and it survives the drive being erased on any Mac with Apple silicon or the T2 security chip. Enrolment through Apple Business Manager makes a Mac show a Remote Management screen during setup and returns it to the company's control. Both have to be released by the account holder or the organisation.

Microsoft Surface devices have their own firmware management, called SEMM. A Surface enrolled in SEMM by a previous owner needs that owner's certificate, or the owner's request through Microsoft, to be released.

Reading a lot before you buy

Start with the spreadsheet. The notes, comments or condition columns are where locks are recorded, under wording such as BIOS locked, password, Computrace, MDM, Autopilot, iCloud or activation lock. A unit noted this way is normally priced as parts. On the lots sold through this site the rule is simple: no BIOS locks, unless the spreadsheet says otherwise.

Read the mix as well as the notes. A large batch of identical machines from one source has usually been through one decommissioning process, so if one unit was cleared properly the rest probably were too, and the same is true the other way round. If anything in a description is unclear, ask before you pay: a seller should be able to say how the units were cleared.

Checking units on arrival

Test a sample of every model as soon as a lot arrives, and every unit if the lot is small. Power each one on and open the firmware settings, usually with F1, F2, F10 or Esc at start-up depending on the maker. You should reach the settings without a password prompt. While you are there, check the state of the tracking module and confirm the machine will start from a USB stick.

Then reset or reinstall Windows on a test unit, connect it to the internet and go through the first setup screens. If a company sign-in page appears, the unit is still registered with Autopilot. For Macs, erase the machine and go through setup with a network connection, watching for an Activation Lock or Remote Management screen.

Note the serial number of any unit that fails and report it to the seller straight away. Lots from this site carry a 7-day window for reporting units that are dead on arrival or not as listed, so test within days, not weeks.

The legitimate routes when a unit is locked

This guide does not cover removing locks. Locks exist to protect the data and property of the organisation that set them. Tools that claim to strip them can damage the motherboard, and using one does not change who the device is registered to.

The legitimate routes all involve the owner. The previous organisation, or the IT supplier that handled its disposal, can supply passwords or release the device from Autopilot, Apple Business Manager, Absolute or SEMM. Manufacturers will reset firmware passwords through their service channels with proof of ownership, often for a fee. Where none of that is possible, treat the unit as parts and price it that way from the start.