Used ThinkPads: checks before purchase and on arrival
A ThinkPad can start Windows normally while access to its UEFI / BIOS remains locked. This checklist helps private buyers, businesses and ITAD operators check access before buying a device or accepting a delivery.
Ask for the right details before buying
Ask the seller for the exact model, generation and Machine Type Model (MTM). A name such as “T14” is not enough to identify the device. Compare the details with the label and, where accessible, the device information in BIOS. Our device finder helps identify the model and shows its current assessment status for our service.
Also establish whether a supervisor password or certificate-based BIOS authentication is configured and who can release access. For a batch, record the answers against each device. The condition of one sample does not automatically describe the whole batch.
Check BIOS access without changing settings
On ThinkPad laptops, press F1 at the Lenovo logo during startup to open UEFI / BIOS Setup. F10 launches the built-in Lenovo UEFI diagnostics; F12 opens the boot options. Diagnostics and the boot menu must be available and must not be locked or disabled in the configuration. Record the access status, then leave Setup without saving changes.
A visible BIOS menu does not prove full access. It may open without the configured supervisor password while protected settings remain greyed out and cannot be changed. Some unprotected options may still be available; this does not establish full administrative access.
Equally, not every greyed-out field indicates a password lock. Options can depend on other settings or be controlled by a broader security configuration. For example, the Device Guard option on older ThinkPads sets Secure Boot and virtualisation options and restricts the boot order. Consider the password or certificate status together with the areas that cannot be changed.
Where possible, ask the seller or responsible IT team to remove an existing protection before handover. Checking access does not require setting a new password or changing Secure Boot, TPM or other security settings.
Record prompts and error messages
Photograph the complete screen and note when it appears: at power-on, when opening BIOS or only in Windows. The exact wording and model details are particularly useful.
- System Security: Supervisor Password Required: Understanding the supervisor prompt.
- 0183: Bad CRC of Security Settings in EFI Variable: Guidance on error 0183.
- 0177: Bad SVP data, stop POST task: Guidance on error 0177.
- A certificate prompt with or without a QR code, possibly showing a block of hexadecimal request data: Understanding CBA.
In our service work, we have encountered the ThinkPad Z13 Gen 1 displaying its CBA request as a hexadecimal block without a QR code. Record these screens in full as well.
These messages have different causes. Do not treat all of them as the same “BIOS password”.
Check other protections separately
| Topic | What else to establish |
|---|---|
| Power-on or drive password | Which prompt appears, and can the seller release it? These protections are distinct from the supervisor password. |
| BitLocker | BitLocker protects data on the drive. A BIOS unlock does not replace a recovery key or decrypt an SSD. |
| Intune and Windows Autopilot | The seller should arrange a complete release with the previous organisation, covering Intune management, Autopilot registration and the associated Microsoft Entra ID identity, formerly Azure AD. |
If Windows first-time setup displays another organisation’s name, record the screen and ask the seller about it. The absence of that screen does not prove a complete release. Network access, Windows version, deployment profile and registration state can all affect what appears during setup. A normal Windows start or a single local check therefore cannot reliably establish every management association.
Ask the seller or responsible IT team to confirm deregistration. Resetting or reinstalling Windows does not replace removal from the previous organisation’s management. You can enquire about assistance with removing an Intune/Autopilot association as a separate, experimental additional service. We establish the requirements and scope for the specific device; this is not included in a BIOS unlock.
A short check for incoming devices
- Match the model, MTM and serial number against the delivery and device records.
- Record whether the device starts, visible damage and known repairs.
- Document BIOS access, protection status and exact prompts without changing settings.
- Check storage and management status under your own procedures; do not browse another party’s data.
- Record unresolved points for each device and clarify the handover with the seller or responsible IT team.
This check focuses on locks and handover. A separate functional check is useful for the battery, display, ports and other hardware.
If you discover a lock after buying
First ask the seller or previous IT team to release access. Keep the purchase and handover records. If access cannot be restored through that route, send us the model, MTM and exact prompt through our contact page or directly in a service request. We establish the possible service scope before you ship anything.
To commission the service, you must be the lawful owner or duly authorised. The guide to device batches and single devices covers preparation for individual and bulk orders.