Removing Surface Pro UEFI Password

[DriftingEverOnwards]

On 10/08/2025 at 22:39, avidgamr said:

I'm not sure. Maybe you missed a step?
Complete guide (I had to do it again today as I forgot my own password!):

 

Download configurator:
https://www.touslesdrivers.com/index.php?v_page=23&v_code=72193
(use tousledrivers server)

 

Go to
https://learn.microsoft.com/en-us/surface/surface-enterprise-management-mode
and use the "copy" button beside "Powershell" under "Self-signed certificate"
(as I said above, use the copy button, do not try to copy/paste yourself)

 

Create a folder in C:\ root folder called "SEMM"

 

Open notepad, paste contents from clipboard above into it. I chose to save
as filename "SSCert.ps1" (and chose "all files" under "Save as type").

 

Change permissions to allow scripts (remember to change it back when finished):
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.5

 

I used PowerShell and typed "C:\SEMM\SSCert.ps1"
(It created the script for me in
"C:\Windows\system32\Demo Certificates" folder)

 

Run configurator you downloaded above (and I chose: Surface Devices/Configuration Package/Certificate Protection
(chose script just made and entered "12345678" (without the quotes))/Password Protection (leave blank)/
Surface Go/Go 2 (left everything enabled)/then next I turned off security, then chose "Windows Installer (MSi)
and saved as "password.msi"

 

Next, in the Windows search box, search for "msiexec" and choose "Run as administrator". Run the file:
I entered "C:\SEMM\password.msi"

 

Reboot

 

Reboot again, this time choosing: Windows/Settings/System/Recovery/Advanced Startup

 

Enter the UEFI settings: Troubleshoot/Advanced Options/UEFI Firmware Settings (then "Restart")
While in the UEFI, jot down the "serial number" for your device as you'll need it later.

 

Reboot.

 

Run configurator again: Reset/Cert/12345678/(serial number from above)/msi again and I named it as "reset.msi"
(in the folder of your choice; I chose the same SEMM folder above)

 

Run msiexec above again and this time run the new "reset.msi" file created above

 

Reboot

 

Boot back into the UEFI settings again (Windows/Settings/System/Recovery/Advanced Startup)

 

Hopefully your password is now removed. If not, you likely have an updated firmware in your
tablet and this won't work (mine says "1.0.31" I believe). Your only option now is to try to
get someone else to remove it for you. This website seems to have people who can do that, somehow...
https://www.badcaps.net/forum/troubleshooting-hardware-devices-and-electronics-theory/troubleshooting-laptops-tablets-and-mobile-devices/bios-requests-only/103830-microsoft-go-2-1927-bios-unlock-way

 

Good luck!

 

P.S. Microsoft, at the moment, still has factory restore images for Surface Go 2:
https://support.microsoft.com/en-us/surface-recovery-image
Sucky part is you MUST create an account to download images now...

Thanks for all your work!

 

I'm noticing some oddities, and can't get past the first reboot.

 

First, when running the configurator to generate password.msi, the Surface Pro 5 is not in the list of Surface Pro models available. It displays only Surface pro, pro4, pro 6, pro 7, etc (see missing_model.png).

 

I followed the instructions (setting security to off), and ran the msi using msiexec /i from an elevated command prompt. The file runs and then prompts me to reboot, which I do.

 

After reboot, it boots to a black screen with a red box asking for the last two characters of the signature and a password. I've tried leaving the password blank, or using gibberish as the first post instructs, but either way I get a message saying that it's incorrect and no eufi configuration is enabled on the machine. It then boots back into windows.

 

The BIOS version is still old, apparently, but Windows is up to date:

BIOS Version/Date    Microsoft Corporation 239.871.768, 11/7/2015

OS Name    Microsoft Windows 10 Pro

Version    10.0.19045 Build 19045

 

Can you help, please?

Thanks

[DriftingEverOnwards]

1 hour ago, DriftingEverOnwards said:

Thanks for all your work!

 

I'm noticing some oddities, and can't get past the first reboot.

 

First, when running the configurator to generate password.msi, the Surface Pro 5 is not in the list of Surface Pro models available. It displays only Surface pro, pro4, pro 6, pro 7, etc (see missing_model.png).

 

I followed the instructions (setting security to off), and ran the msi using msiexec /i from an elevated command prompt. The file runs and then prompts me to reboot, which I do.

 

After reboot, it boots to a black screen with a red box asking for the last two characters of the signature and a password. I've tried leaving the password blank, or using gibberish as the first post instructs, but either way I get a message saying that it's incorrect and no eufi configuration is enabled on the machine. It then boots back into windows.

 

The BIOS version is still old, apparently, but Windows is up to date:

BIOS Version/Date    Microsoft Corporation 239.871.768, 11/7/2015

OS Name    Microsoft Windows 10 Pro

Version    10.0.19045 Build 19045

 

Can you help, please?

Thanks

Just in case, I tried getting an even older version of the configurator from touslesdrivers.com, this time it was SurfaceUEFI_Configurator_v2.112.139.0_x64.msi.

 

It, too, did not show the Surface Pro 5/2017 as an option, and behaved the same.

Edited August 19, 2025 by DriftingEverOnwards
Misspelling

[avidgamr]

I don't own a Pro 5, I have two Surface Go 2 models. Perhaps posting to the website I mentioned previously and someone can decipher the password for you? I can't help. Sorry.

[DriftingEverOnwards]

3 hours ago, avidgamr said:

I don't own a Pro 5, I have two Surface Go 2 models. Perhaps posting to the website I mentioned previously and someone can decipher the password for you? I can't help. Sorry.

 

Sounds like I'll have to get a bios programmer and open this thing up at some point.

Thanks for checking!

 

[Bluey]

On 11/08/2025 at 12:39, avidgamr said:

I'm not sure. Maybe you missed a step?
Complete guide (I had to do it again today as I forgot my own password!):

 

Download configurator:
https://www.touslesdrivers.com/index.php?v_page=23&v_code=72193
(use tousledrivers server)

 

Go to
https://learn.microsoft.com/en-us/surface/surface-enterprise-management-mode
and use the "copy" button beside "Powershell" under "Self-signed certificate"
(as I said above, use the copy button, do not try to copy/paste yourself)

 

Create a folder in C:\ root folder called "SEMM"

 

Open notepad, paste contents from clipboard above into it. I chose to save
as filename "SSCert.ps1" (and chose "all files" under "Save as type").

 

Change permissions to allow scripts (remember to change it back when finished):
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.5

 

I used PowerShell and typed "C:\SEMM\SSCert.ps1"
(It created the script for me in
"C:\Windows\system32\Demo Certificates" folder)

 

Run configurator you downloaded above (and I chose: Surface Devices/Configuration Package/Certificate Protection
(chose script just made and entered "12345678" (without the quotes))/Password Protection (leave blank)/
Surface Go/Go 2 (left everything enabled)/then next I turned off security, then chose "Windows Installer (MSi)
and saved as "password.msi"

 

Next, in the Windows search box, search for "msiexec" and choose "Run as administrator". Run the file:
I entered "C:\SEMM\password.msi"

 

Reboot

 

Reboot again, this time choosing: Windows/Settings/System/Recovery/Advanced Startup

 

Enter the UEFI settings: Troubleshoot/Advanced Options/UEFI Firmware Settings (then "Restart")
While in the UEFI, jot down the "serial number" for your device as you'll need it later.

 

Reboot.

 

Run configurator again: Reset/Cert/12345678/(serial number from above)/msi again and I named it as "reset.msi"
(in the folder of your choice; I chose the same SEMM folder above)

 

Run msiexec above again and this time run the new "reset.msi" file created above

 

Reboot

 

Boot back into the UEFI settings again (Windows/Settings/System/Recovery/Advanced Startup)

 

Hopefully your password is now removed. If not, you likely have an updated firmware in your
tablet and this won't work (mine says "1.0.31" I believe). Your only option now is to try to
get someone else to remove it for you. This website seems to have people who can do that, somehow...
https://www.badcaps.net/forum/troubleshooting-hardware-devices-and-electronics-theory/troubleshooting-laptops-tablets-and-mobile-devices/bios-requests-only/103830-microsoft-go-2-1927-bios-unlock-way

 

Good luck!

 

P.S. Microsoft, at the moment, still has factory restore images for Surface Go 2:
https://support.microsoft.com/en-us/surface-recovery-image
Sucky part is you MUST create an account to download images now...

@avidgamr

 

Hey - Thanks for the instructions. I followed them exactly, and have the exact same issue with 2x Surface laptop 3's

These have been wiped, so i can't get into windows to run the msi packages, so i tried the winpe image approach through the UEFI configurator, and that didn't work either

It just reboots after loading the SEMM config, then the Red box that comes up never accepts the "random password" that i'm typing in it, and locks after 3 attempts

 

Any other recommendations for trying to get around this on a PC without an OS? Maybe a boot environment could help?

The UEFI version is 19.101.140

[Shinning_Star]

I just did successfully remove the uefi password from surface go. Please use this version. i try other versions and failed. SurfaceUEFI_Configurator_v2.112.139.0_x64.msi  https://www.touslesdrivers.com/index.php?v_page=23&v_code=76891 (download from touslesdrivers server). the successful step is the same as the step show in other people step.  1. download Surface UEFI Configurator 2. install Surface UEFI Configurator 3. Create a Self-Signed Certificate

4. Create a Configuration Package

1. Open Surface UEFI Configurator (Start Menu → Surface UEFI Configurator).

2. Select "Create a new configuration package" → "Configuration Package".

3. Browse to select your .pfx certificate (e.g., C:\SurfaceSEMM.pfx).

4. Enter certificate password: 12345678.

5. UEFI Password field: Leave blank (do not enter the old unknown password).

6. Save the package as an .msi file (e.g., ConfigPackage.msi).

---

5. Install the Configuration Package

1. Open Command Prompt as Administrator.

2. Navigate to the folder containing the .msi.

3. Install using:

cmd

msiexec /i "ConfigPackage.msi"

4. Reboot when prompted.

6. After Computer restart it as in redbox to enter Thumbnail print last Two Number. Just enter worng number and enter again and again until it reach limit. (NOw your surface uefi should be free of password). you don't have to do anything other step. 

[Shinning_Star]

Just now, Shinning_Star said:

I just did successfully remove the uefi password from surface go. Please use this version. i try other versions and failed. SurfaceUEFI_Configurator_v2.112.139.0_x64.msi  https://www.touslesdrivers.com/index.php?v_page=23&v_code=76891 (download from touslesdrivers server). the successful step is the same as the step show in other people step.  1. download Surface UEFI Configurator 2. install Surface UEFI Configurator 3. Create a Self-Signed Certificate

4. Create a Configuration Package

1. Open Surface UEFI Configurator (Start Menu → Surface UEFI Configurator).

2. Select "Create a new configuration package" → "Configuration Package".

3. Browse to select your .pfx certificate (e.g., C:\SurfaceSEMM.pfx).

4. Enter certificate password: 12345678.

5. UEFI Password field: Leave blank (do not enter the old unknown password).

6. Save the package as an .msi file (e.g., ConfigPackage.msi).

---

5. Install the Configuration Package

1. Open Command Prompt as Administrator.

2. Navigate to the folder containing the .msi.

3. Install using:

cmd

msiexec /i "ConfigPackage.msi"

4. Reboot when prompted.

6. After Computer restart it as in redbox to enter Thumbnail print last Two Number. Just enter worng number and enter again and again until it reach limit. (NOw your surface uefi should be free of password). you don't have to do anything other step. 

 

[Shinning_Star]

On 21/08/2025 at 20:56, DriftingEverOnwards said:

 

Sounds like I'll have to get a bios programmer and open this thing up at some point.

Thanks for checking!

 

I just did successfully remove the uefi password from surface go. Please use this version. i try other versions and failed. SurfaceUEFI_Configurator_v2.112.139.0_x64.msi  https://www.touslesdrivers.com/index.php?v_page=23&v_code=76891 (download from touslesdrivers server). the successful step is the same as the step show in other people step.  1. download Surface UEFI Configurator 2. install Surface UEFI Configurator 3. Create a Self-Signed Certificate

4. Create a Configuration Package

1. Open Surface UEFI Configurator (Start Menu → Surface UEFI Configurator).

2. Select "Create a new configuration package" → "Configuration Package".

3. Browse to select your .pfx certificate (e.g., C:\SurfaceSEMM.pfx).

4. Enter certificate password: 12345678.

5. UEFI Password field: Leave blank (do not enter the old unknown password).

6. Save the package as an .msi file (e.g., ConfigPackage.msi).

---

5. Install the Configuration Package

1. Open Command Prompt as Administrator.

2. Navigate to the folder containing the .msi.

3. Install using:

cmd

msiexec /i "ConfigPackage.msi"

4. Reboot when prompted.

6. After Computer restart it as in redbox to enter Thumbnail print last Two Number. Just enter worng number and enter again and again until it reach limit. (NOw your surface uefi should be free of password). you don't have to do anything other step. 

[Mrezagsi]

I just made an account in this website to say thank you. I have no clue on coding and what I was doing but it worked. I got mine as a second hand and it seems like it used to be for an organization so the book was locked. I downloaded the older version of the toolkit ( the link is in one of the comments ) and I followed the steped and it worked. Thank you so much . 

I did on Surface Go Gen 1 2018 , 4GB ram version

[jwk70]

I am confused on "The creation of a PFXCert" After I copy and paste into Notepad  what do I "Name"  the file when I "Save As". I do understand to change file type to all files as well. Sorry I am a noob when it comes to this kinda stuff but do have basic knowledge.

What exactly do i change? Thanks in advance

 

 

 

[MielieBom]

Thank you for the info on this thread. I have a Surface Laptop 4. I get to the red screen asking for the last 2 digits of the thumbprint and password. It does not disable the password. 

[Dario]

On 10/08/2025 at 19:39, avidgamr said:

I'm not sure. Maybe you missed a step?
Complete guide (I had to do it again today as I forgot my own password!):

 

Download configurator:
https://www.touslesdrivers.com/index.php?v_page=23&v_code=72193
(use tousledrivers server)

 

. . . . . 

 

I can confirm that these instructions worked for me on a Surface Go 2.  I had to do both UEFI configurator files, the password one and the reset one.  My UEFI BIOS password was still there before installing the reset package.

 

Info from the Surface App:

 

• Surface model: Surface Go 2 Model 1927 m3
• UEFI: 1.0.31
• App version: 76.2010.134.0
• BIOS Version/Date: Microsoft Corporation 1.0.31 06/04/2024
• Touch driver: 100.38.0.0
• Wi-Fi driver: 23.30.0.6
• OS build: 22631.6783
• Processor: Intel(R) Core(TM) m3-8100Y CPU @ 1.10GHz
• Installed RAM: 8 GB
• GPU: Intel(R) UHD Graphics 615

[Dario]

On 01/02/2026 at 18:14, jwk70 said:

I am confused on "The creation of a PFXCert" After I copy and paste into Notepad  what do I "Name"  the file when I "Save As". I do understand to change file type to all files as well. Sorry I am a noob when it comes to this kinda stuff but do have basic knowledge.

What exactly do i change? Thanks in advance

You name it anything you want,  You will simply execute it as a batch script using PowerShell, so the file name makes no difference.

[wranglerguy1989]

I’m trying to use the steps in this thread to remove the UEFI password from a Surface Pro 4 that I purchased from Goodwill. I successfully created the certificate, installed SurfaceUEFI_Configurator_v2.112.139.0_x64, and created the configuration package using the certificate while leaving the existing BIOS/UEFI password field blank and setting the security settings to off as described.

 

After installing the generated MSI package and rebooting, I do get the red enrollment screen as expected. However, after completing the process and rebooting back into Windows, the UEFI password is still present when trying to enter the UEFI settings.

 

I also went through the full process and created and installed the Reset package afterward to see if completing all the steps would clear the password, but the UEFI password was never removed. Has anyone successfully done this recently on a Surface Pro 4, or is this workaround patched on newer firmware versions?

[tstokes94]

I'm still having this issue, has anyone found a workaround?