Removing Surface Pro UEFI Password

[Aprice]

Hi All,

 

Our main site has quite a few Surface Pro 5 and 6 devices still in use, all running pretty well still. But all have a BIOS password that wasn't provided at handover.

 

All the research I had done suggested that it wasn't possible to clear the UEFI password without disassembly and flashing a chip.

 

Turns out you can actually, it's rather convoluted but is possible.

 

The process I found leverages the SEMM mode and the Surface UEFI Configurator application.

 

Configurator can be downloaded from here:

https://learn.microsoft.com/en-us/surface/surface-enterprise-management-mode

 

 

First you have to generate a certificate, I found a self signed cert to work fine.

 

Powershell script is in the link above, and password protects the certificate with the password 12345678

 

Once that's complete run the configurator from the start menu, and select Configuration Package. It asks for the Cert and Password. The UEFI password leave blank. The next settings I don't believe matter much, I chose to make it as least restrictive just in case. Then save the package as an MSI.

 

You then can run the MSI (have to run from msiexec.exe for some reason)

 

Reboot.

 

When the surface reboots a red box appears and asks for 2 characters from the certificate and the UEFI password we don't know. I just entered rubbish until it closed and booted back into windows.

 

When you shut down next and enter the UEFI you will now have access but everything will say managed by your organisation. Take down the serial number for later.

 

Boot back into windows and run the configuration tool, but select the reset package and enter the serial number. Now save and run this, again with msiexec /i

 

Now the UEFI should be clear of both the password and SEMM stuff.

 

Hopefully that helps someone one day.

[SteveMC]

Thanks for this - got me out of a hole! By the looks of things it should be able to reset the UEFI security on pretty much any Surface device (worked on a 1st-gen Surface Go for me).

[Techminator]

Hello Aprice

Could you please guide me on the following:

How do I generate a valid certificate? I tried various methods but the UEFI Configurator gives error upon selecting it.

 

Update:-

OK I was able to generate a certificate and create the package, transfer it to the actual Surface Pro 5 and install it and then created another package using the reset option and installed that as well.

 

But it still asks for the UEFI password.

 

Please help.

Edited May 24, 2023 by Techminator

[Techminator]

Maybe you can help me?

[Aprice]

Maybe you can help me?

 

I'll have to try it again to jog my memory,

 

Might be able to find a spare Surface at some point today to test on.

[Aprice]

I'll have to try it again to jog my memory,

 

Might be able to find a spare Surface at some point today to test on.

 

Just tested again and now this doesn't appear to work anymore. I'm presuming Microsoft have fixed the bit that ignores the password failing when the red box opens.

[Techminator]

Thank you so much for trying this out. I just wanted to confirm that at the red box section the two letters I enter are CA and I put the password as anything and press enter untill it reboots.

 

If Microsoft has fixed it, I'm guessing it would be when I updated windows so if I erase and reinstall and then try this it may work?

 

Please let me know your thoughts.

[Aprice]

Yep, same here now. I'm guessing it will be an updated version of the Surface Config tool that has broken this (or fixed it depending on how you look at it).

 

When I wrote the first post it was also on 22H2.

[Techminator]

That's means an older version of the surface config tool will work. Do you have that on your PC by any chance? If not I'll try to find it online. But I'm guessing an older version might work.

[Aprice]

I'll have a look, it might still be on the first on I did.

[Aprice]

Quick update, just found a reddit post from a year back with the same version number for the utility, maybe it's the devices firmware that broke this.

 

Couldn't find the utility on the first device either, looks like I imaged it after clearing the password.

[Techminator]

May I have the link to that reddit post please? I'll try it anyways.

[Techminator]

I just saw that SteveMC was able to get it to work and his comment has been posted just a few days back so they must have updated it recently. Maybe Steve has the older version?

[hggfgfgfgfaaKKINUefiLock]

HI THANKS FOR TUTORIALS AND HELP SO FAR....

 

I Have made it partly through but am very stuck on... the following.

 

SURFACE LAPTOP 3

 

GOOD: (Theres heaps which exact one please?) Powershell script is in the link above,

 

and password protects the certificate with the password 12345678

 

OK: (But am I supposed to be doing so on the target device as I cannot acces to run configurator.??)

Once that's complete run the configurator from the start menu, and select Configuration Package.

MORE DETAIL PLEASE SCREENSHOTS???

 

It asks for the Cert and Password. The U

EFI password leave blank. The next settings I don't believe matter much, I chose to make it as least restrictive just in case. Then save the package as an MSI.

Ok I got that far I think.

 

 

You then can run the MSI (have to run from msiexec.exe for some reason)

WHEN WHERE WHICH DEVICE and HOW? cmd or double click or what

??

 

Reboot. Im stuck?? at UEFI Login password. I cannot reboot the target device which this tutorial take for granted.?

Or am i mistakenly assessing where I should be running the configurator

 

BOI!!! DID GET A TWO DIGIT CODE FROM A DIFF DEVICE THOUGH> When the surface reboots a red box appears and asks for 2 characters from the certificate and the UEFI password we don't know. I just entered rubbish until it closed and booted back into windows.

>>>>>>>>>From here on have not comkpleted.

 

 

When you shut down next and enter the UEFI you will now have access but everything will say managed by your organisation. Take down the serial number for later.

 

Boot back into windows and run the configuration tool, but select the reset package and enter the serial number. Now save and run this, again with msiexec /i

 

Now the UEFI should be clear of both the password and SEMM stuff.

 

 

 

 

ANY HELP WOULD BE AWESOME THANKS !!

[Aprice]

HI THANKS FOR TUTORIALS AND HELP SO FAR....

 

I Have made it partly through but am very stuck on... the following.

 

SURFACE LAPTOP 3

 

GOOD: (Theres heaps which exact one please?) Powershell script is in the link above,

 

and password protects the certificate with the password 12345678

 

OK: (But am I supposed to be doing so on the target device as I cannot acces to run configurator.??)

Once that's complete run the configurator from the start menu, and select Configuration Package.

MORE DETAIL PLEASE SCREENSHOTS???

 

It asks for the Cert and Password. The U

EFI password leave blank. The next settings I don't believe matter much, I chose to make it as least restrictive just in case. Then save the package as an MSI.

Ok I got that far I think.

 

 

You then can run the MSI (have to run from msiexec.exe for some reason)

WHEN WHERE WHICH DEVICE and HOW? cmd or double click or what

??

 

Reboot. Im stuck?? at UEFI Login password. I cannot reboot the target device which this tutorial take for granted.?

Or am i mistakenly assessing where I should be running the configurator

 

BOI!!! DID GET A TWO DIGIT CODE FROM A DIFF DEVICE THOUGH> When the surface reboots a red box appears and asks for 2 characters from the certificate and the UEFI password we don't know. I just entered rubbish until it closed and booted back into windows.

>>>>>>>>>From here on have not comkpleted.

 

 

When you shut down next and enter the UEFI you will now have access but everything will say managed by your organisation. Take down the serial number for later.

 

Boot back into windows and run the configuration tool, but select the reset package and enter the serial number. Now save and run this, again with msiexec /i

 

Now the UEFI should be clear of both the password and SEMM stuff.

 

 

 

 

ANY HELP WOULD BE AWESOME THANKS !!

 

 

Hi, As of the last time I tested this I found the process no longer worked. I suspect that Microsoft have released a new version that has 'fixed' this loophole.

 

It did also rely on already having admin access to the OS running on the system, so wouldn't make any difference if you can't get into the OS in the first place.

[NotEvil]

Hello there. I only wanted to report that I tried to go through this tutorial.

 

I wiped everything and installed fresh Windows 11 22H2 on Surface Pro 7.

Got to the red box, but it didn't accept rubbish.

 

Probably a firmware update that came with an update fixed that hole.

So I'm stuck with 50% of the battery.

 

Thanks for sharing anyway.

Edited May 27, 2024 by NotEvil

[XMSK]

.

 

 

Hi,

 

I do everythings what u wrote down, but the last Surface IT tool not support any device below 7.

 

So i think thats why don’t work on my 5 Pro.

 

Somebody have oldest version from the IT tool?

 

 

Thank you

[kimsec]

Anyone got this working lately? Just bought an Surface Book 3, old owner does not remember password to UEFI.. going to return it if i dont get this resolved ASAP.

Have a nice day =)

[avidgamr]

Download the older configurator here:

https://www.touslesdrivers.com/index.php?v_page=23&v_code=72193

(choose the touslesdrivers.com server)

Go here and click on the "Copy" button beside the "PowerShell" header (do NOT try to copy/paste yourself).

https://learn.microsoft.com/en-us/surface/surface-enterprise-management-mode

Paste it into notepad or your favorite text editor, making sure to choose "Save As Type" as "All Files".

Follow instructions on post 1. It worked on my MS Surface Go 2. Thanks to the original poster by the way! It was a life saver!

 

P.S. If you need the "ARM" version, download from here:

https://www.touslesdrivers.com/index.php?v_page=23&v_code=72194&v_langue=en

Edited February 27, 2025 by avidgamr
adding info

[Engleschmidt]

On 27/02/2025 at 17:00, avidgamr said:

Download the older configurator here:

https://www.touslesdrivers.com/index.php?v_page=23&v_code=72193

(choose the touslesdrivers.com server)

Go here and click on the "Copy" button beside the "PowerShell" header (do NOT try to copy/paste yourself).

https://learn.microsoft.com/en-us/surface/surface-enterprise-management-mode

Paste it into notepad or your favorite text editor, making sure to choose "Save As Type" as "All Files".

Follow instructions on post 1. It worked on my MS Surface Go 2. Thanks to the original poster by the way! It was a life saver!

 

P.S. If you need the "ARM" version, download from here:

https://www.touslesdrivers.com/index.php?v_page=23&v_code=72194&v_langue=en

 

I know this is much later, but I am having the same problem. I appreciate the link, and I was able to download the Configurator, but I am getting an application error at the end which says "Reason: Corrupt installation. Please reinstall Surface UEFI Configurator".

 

Earlier in the process, it also wouldn't let me select any of the "Pro" series as the device I want to target. When I tried to select it, it immediately deselects it, but would at least let me continue from there. Maybe that is part of the issue?

[avidgamr]

I'm not too sure on your problem. Perhaps an anti-virus program interfering? If applicable disable your anti-virus program temporarily and try reinstalling and running it... Or perhaps your operating system installed is a 32 bit version? (and Must be a 64 bit OS to run this program) Or perhaps try uninstalling and reinstalling the program? You  might also make sure the installer has downloaded correctly by checking the hash. Mine says "725BB66538C3C6D6D451EF007DA807AFA8E62816D02E29CF7F2F30CB2093C394" (Sha-256)

Compare your downloaded files' hash to mine:

https://sourceforge.net/projects/filechecksumutility/

Mayhaps someone else will chime in who can help you better...

Good luck.

Edited July 3, 2025 by avidgamr
typo and clarification

[Engleschmidt]

I was able to fix that problem, turned out that my drive was in a broken BitLocker state. I reinitialized BitLocker, and then removed it, And I no longer had the problem that I was having. Unfortunately, the trick recommended did not work. It is still asking for a password. Thanks a ton for your help though!

[FitImagination]

On 27/02/2025 at 22:00, avidgamr said:

Download the older configurator here:

https://www.touslesdrivers.com/index.php?v_page=23&v_code=72193

(choose the touslesdrivers.com server)

Go here and click on the "Copy" button beside the "PowerShell" header (do NOT try to copy/paste yourself).

https://learn.microsoft.com/en-us/surface/surface-enterprise-management-mode

Paste it into notepad or your favorite text editor, making sure to choose "Save As Type" as "All Files".

Follow instructions on post 1. It worked on my MS Surface Go 2. Thanks to the original poster by the way! It was a life saver!

 

P.S. If you need the "ARM" version, download from here:

https://www.touslesdrivers.com/index.php?v_page=23&v_code=72194&v_langue=en

 

Hi Thanks so much for this update. I was so excited to see I might be able to fix my device but im still struggling sadly.

 

Everything seems to follow the method as per the original post. Im using the downloaded from touslesdrivers, the checksum is correct. But i still get prompted for a password. Did you have to follow anything in a different way to the original post?

 

I get the red box asking for the 2 digits and password, i skip passed that and into windows. I create the package using the 12 digit serial number. (i even double checked the serial number in windows and the limited access UEFI. I think the only difference i can spot from the original post is where they say "When you shut down next and enter the UEFI you will now have access but everything will say managed by your organisation", I dont have access to everything, I get prompted for the password and can click cancel to enter the bios with limited access. 

 

thanks for any advice you can offer.

[avidgamr]

I'm not sure. Maybe you missed a step?
Complete guide (I had to do it again today as I forgot my own password!):

 

Download configurator:
https://www.touslesdrivers.com/index.php?v_page=23&v_code=72193
(use tousledrivers server)

 

Go to
https://learn.microsoft.com/en-us/surface/surface-enterprise-management-mode
and use the "copy" button beside "Powershell" under "Self-signed certificate"
(as I said above, use the copy button, do not try to copy/paste yourself)

 

Create a folder in C:\ root folder called "SEMM"

 

Open notepad, paste contents from clipboard above into it. I chose to save
as filename "SSCert.ps1" (and chose "all files" under "Save as type").

 

Change permissions to allow scripts (remember to change it back when finished):
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.5

 

I used PowerShell and typed "C:\SEMM\SSCert.ps1"
(It created the script for me in
"C:\Windows\system32\Demo Certificates" folder)

 

Run configurator you downloaded above (and I chose: Surface Devices/Configuration Package/Certificate Protection
(chose script just made and entered "12345678" (without the quotes))/Password Protection (leave blank)/
Surface Go/Go 2 (left everything enabled)/then next I turned off security, then chose "Windows Installer (MSi)
and saved as "password.msi"

 

Next, in the Windows search box, search for "msiexec" and choose "Run as administrator". Run the file:
I entered "C:\SEMM\password.msi"

 

Reboot

 

Reboot again, this time choosing: Windows/Settings/System/Recovery/Advanced Startup

 

Enter the UEFI settings: Troubleshoot/Advanced Options/UEFI Firmware Settings (then "Restart")
While in the UEFI, jot down the "serial number" for your device as you'll need it later.

 

Reboot.

 

Run configurator again: Reset/Cert/12345678/(serial number from above)/msi again and I named it as "reset.msi"
(in the folder of your choice; I chose the same SEMM folder above)

 

Run msiexec above again and this time run the new "reset.msi" file created above

 

Reboot

 

Boot back into the UEFI settings again (Windows/Settings/System/Recovery/Advanced Startup)

 

Hopefully your password is now removed. If not, you likely have an updated firmware in your
tablet and this won't work (mine says "1.0.31" I believe). Your only option now is to try to
get someone else to remove it for you. This website seems to have people who can do that, somehow...
https://www.badcaps.net/forum/troubleshooting-hardware-devices-and-electronics-theory/troubleshooting-laptops-tablets-and-mobile-devices/bios-requests-only/103830-microsoft-go-2-1927-bios-unlock-way

 

Good luck!

 

P.S. Microsoft, at the moment, still has factory restore images for Surface Go 2:
https://support.microsoft.com/en-us/surface-recovery-image
Sucky part is you MUST create an account to download images now...

Edited August 11, 2025 by avidgamr
link not posting correctly

[avidgamr]

Forgot these details: 

 

Change permissions to allow scripts (remember to change it back when finished):

 

Open PowerShell (Run as administrator)

 

Type "Get-ExecutionPolicy" (no quotes)

 

It will likely say "Restricted" in return...

If so, then type "Set-ExecutionPolicy -ExecutionPolicy Unrestricted" (no quotes)

 

Verify the change by asking it again afterwards:

Type "Get-ExecutionPolicy" (no quotes)

 

As I said before, it's recommended to change it back to Restricted when finished:

"Set-ExecutionPolicy -ExecutionPolicy Restricted"

Edited August 13, 2025 by avidgamr
forgot to mention using PowerShell