Skip to content 
BIOS-Passwort
A BIOS password protects company devices against unauthorized changes. When decommissioning, however, it can become an obstacle: a locked notebook can often neither be fully tested nor set up again. This entry explains which types of passwords exist and what to consider before handing over devices.
In brief
A BIOS password is a password stored in a computer’s firmware (BIOS or UEFI) that protects the startup of the device or changes to the firmware settings. It works independently of the operating system, which is why reinstalling does not help against it. When decommissioning IT, BIOS passwords should be removed before handover, because locked devices are difficult to erase, test and resell.
What is a BIOS password?
BIOS and its successor UEFI are the Firmwarethat starts first when a PC is switched on. It checks the hardware and then hands over to the operating system. Passwords can be stored in this firmware. Because they reside in the memory of the motherboard, they are retained even if the hard drive is replaced or Windows is reinstalled.
Companies set BIOS passwords so that nobody changes the boot order, switches off security functions such as Secure Boot or the TPM off, or boots a foreign system. They are often set centrally using manufacturer tools or device management, for example with Microsoft Intune.
Which types of BIOS passwords exist
| Password type | Protects | Consequence when decommissioning |
|---|---|---|
| Administrator or supervisor password | Changes to the firmware settings | Boot order and security functions cannot be adjusted, for example for the erasure software |
| Startup or power-on password | The startup of the device | Device does not start without the password, testing and erasure are blocked |
| Hard drive password | Access to the data carrier itself | Data carrier is locked even in another device; without the password, destruction is often the only option |
Macs have a comparable firmware password or security functions linked to the Apple account. Anti-theft solutions anchored in the firmware work in a similar way, such as Computrace.
What to note when retiring devices
A locked device is barely usable for reuse. Without access to the firmware, it is not possible to boot from an erasure medium, fully test the hardware or set up a new operating system. The Residual value therefore drops considerably; in the worst case, the only option left is recycling as raw material.
- Remove BIOS and hard drive passwords centrally before devices are collected.
- Note devices with a lock in the device list so that they do not come as a surprise.
- Check during offboarding that returned devices do not carry any private passwords.
A checklist for returning devices is provided by the guide offboarding checklist for IT hardware. What else matters when selling older PCs can be read in Selling used PCs.
Rule of thumb: the BIOS password protects the device during operation; before handover it must be removed, otherwise it protects the device against any further use.
BIOS password and Second IT
Second IT erases data carriers using Blancco software and issues a digitally signed erasure certificate for each device. Data carriers that cannot be erased in an audit-proof manner are destroyed in-house in accordance with DIN 66399, certified for security level H-5. So that devices can be erased and reused, firmware locks should be removed before collection. More on certified data deletion.
Frequently asked questions about the BIOS password
What should I do if the BIOS password has been forgotten?
First ask your IT department whether the password is managed centrally. If not, many manufacturers offer a reset procedure through their support, usually only with proof that you own the device.
Does reinstalling Windows help against a BIOS password?
No. The password is stored in the firmware on the motherboard and is independent of the operating system and the data carrier.
Can a device with a BIOS password be erased securely?
Often not without the password, because the device cannot boot from an erasure medium. Removed data carriers can possibly be erased separately. If a hard drive password is set, physical destruction is usually the only option.
Do I have to remove BIOS passwords before handing over devices?
Strongly recommended. Locked devices are difficult to erase, test and resell. Remove BIOS and hard drive passwords centrally before collection and note devices with a lock in the device list.
Does a BIOS password affect the resale value?
Yes. Without access to the firmware, it is not possible to boot from an erasure medium, fully test the hardware or set up a new operating system. The residual value therefore drops considerably.
Hand over devices unlocked and receive more value.
Send us your device list. You will receive your offer in 48 hours on average.