Forgot Admin Password on ThinkPad? UEFI Fix

If you forgot the admin password on a ThinkPad that is pre-installed in UEFI boot mode, you cannot simply reset it with software or a CMOS jumper on most modern models — the password is stored in the TPM or in a secure chip, and the only reliable fix is a motherboard replacement or a service from Lenovo. However, there are a few legitimate steps you can take depending on your exact model and whether the password is a BIOS admin password or a hard disk password. This article explains what your options are, what actually works, and what to avoid.

Understanding the Types of Passwords

ThinkPads have several password layers, and knowing which one you are locked out of changes everything:

Power-on password (POP) — asked before the OS loads. Can sometimes be cleared by removing the CMOS battery on older models, but on UEFI-only systems this is rarely possible.
Supervisor (admin) password — restricts access to BIOS/UEFI settings. This is the one that usually blocks boot changes and is the hardest to remove.
Hard disk password (HDP) — locks the drive itself, even if you move it to another machine. This is stored on the drive and on the TPM.
NVMe password — similar to HDP but for NVMe SSDs; the drive is encrypted at the controller level.

On a modern ThinkPad (2015 and later, especially those with Intel 6th gen or newer), the supervisor password is stored in the EC (embedded controller) and the TPM. Simply resetting the CMOS does not clear it, because the EC retains the password hash in its own non-volatile memory.

Why the Standard CMOS Reset Fails

Many older guides tell you to open the laptop, remove the round silver battery (CR2032), wait 30 seconds, and put it back. That works on pre-2010 models where the BIOS password was stored in a separate EEPROM that lost power. On UEFI-era ThinkPads, the password is stored in the EC’s internal flash, which is always powered by the main battery or the backup capacitor. Removing the CMOS battery does not erase it. In fact, some models will simply show a “Bad CRC” error and then re-ask for the password.

Another common trick — shorting two pins on the BIOS chip — also fails because the EC checks the password hash against a stored value and will not boot if it is tampered with. The only way to bypass it is to reprogram the BIOS chip with a hardware programmer, which requires desoldering or using a clip, and even then the EC may still hold the password.

What Actually Works: Legitimate Options

If you are locked out, here are the realistic paths, in order of ease:

Use a Lenovo service center — They have the tools to reflash the BIOS/EC with a special service code. You will need proof of purchase, and the service is usually paid. This is the only official way.
Try a “master password” for the hard disk — For HDP, Lenovo has a master password generator that is not public, but some third-party tools exist for older models. These are not reliable for NVMe drives.
Replace the motherboard — On many ThinkPads, the motherboard is the cheapest and fastest fix if the laptop is older. The password is tied to the board, so a new board boots clean.
Use a BIOS programmer — If you are technically skilled, you can flash a clean BIOS image to the SPI flash chip using a CH341A programmer and a SOIC clip. This works for the BIOS password, but the EC password may still block boot on some models. You must also have a backup of your original BIOS or a matching image from the internet.

None of these are “free” or “instant”. The only free method is to contact Lenovo support and see if they will provide a service code, but they almost never do for individuals without a business contract.

What About Windows Reset or Recovery?

If the password is only on the BIOS, you can often still boot into Windows if the drive is not encrypted. From there, you can use Windows recovery options to reset your Microsoft account password or create a new local admin. However, you cannot change the BIOS admin password from Windows because it is stored in firmware, not in the OS. If you have BitLocker enabled, you will need your recovery key, which is stored in your Microsoft account or printed when you set it up.

If you are locked out of Windows itself (forgot the login password), that is a separate issue. You can use the built-in recovery environment (WinRE) to reset the password, but only if you have a recovery drive or installation media. This does not touch the BIOS password.

Prevention and Best Practices for the Future

Once you regain access, take these steps to avoid a repeat:

Write down the supervisor password and store it in a safe place (not on a sticky note on the laptop).
Disable the BIOS password if you do not need it, or set a simple one that you can remember.
Set up a Windows Hello PIN or biometric login so you do not rely on a long password.
Enable BitLocker and store the recovery key in your Microsoft account.
Keep a backup of your data, because a motherboard replacement may mean you cannot access the drive if it has an HDP.

Common Misconceptions

“I can just remove the CMOS battery.” As explained, this does not work on UEFI ThinkPads. It only works on very old models (pre-2005 or some early Core 2 Duo).

“There is a hidden backdoor password.” Lenovo does not publish a universal backdoor. Some older models had a service password that was leaked, but it is model-specific and not reliable for modern laptops.

“I can use a bootable USB to clear it.” No, because the BIOS password is checked before any USB device is read. The only exception is if you have a “BIOS update” that can be run from Windows, but that requires you to be in Windows first, and it will not clear a supervisor password.

Frequently Asked Questions

Can I reset the admin password by pressing F9 or F2 at boot?

No. F2 opens the BIOS setup, but if a supervisor password is set, you cannot enter setup without it. F9 is for boot menu, not password reset.

Will removing the hard drive help?

If the password is only on the BIOS, removing the drive does nothing. If it is a hard disk password, the drive will still be locked when you connect it to another computer. For NVMe, the password is on the drive’s controller, so it stays locked.

Is there a way to bypass the password using a serial port?

Some very old ThinkPads had a serial port that could be used to reset the BIOS, but modern models do not. The UEFI firmware does not expose such an interface.

How much does a motherboard replacement cost?

It varies by model and region, but for a typical ThinkPad T-series, you can expect to pay anywhere from $100 to $300 for a used board. Labor is extra if you pay a shop. Compare that to a service center fee, which is often less.

Can I use a Linux tool to reset the password?

No. Linux tools like `setpci` or `flashrom` cannot reset the supervisor password because it is stored in the EC, not in the BIOS flash that is accessible from the OS. You would need to physically program the chip.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →