Managing supervisor credentials

Depending on the Absolute product licenses associated with your account, the Remote Supervisor Credentials feature may not be available.

Supervisor credentials—also known as administrator or firmware passwords—are a firmware-level security control that restricts access to UEFI/BIOS settings. They help prevent unauthorized changes to critical device configuration, such as boot order, Secure Boot settings, and hardware options, reducing the risk of device tampering. Setting or changing supervisor credentials locally requires physical access to the device and entry into UEFI/BIOS setup during startup.

Using the Remote Supervisor Credentials (RSVC) feature, you can remotely and securely create, update, or remove supervisor credentials on supported Lenovo devices. Credentials can be in the following forms:

  • Certificate

    A trusted digital certificate that is stored in a device's firmware and lets administrators access UEFI/BIOS settings

    For more information about certificate authentication, see Certificate-based BIOS Authentication in Lenovo documentation.

  • Password

    A text password that lets administrators access UEFI/BIOS settings

You can submit a Manage Supervisor Credentials request from the Device Details page of a device. You can also select devices in a device group, device group folder, or device report to submit a request for all selected devices. Alternatively, you can upload a file of device identifiers and submit a request.

  • The RSVC feature does not store your devices' supervisor credentials. You are responsible for maintaining them in a secure, centralized secret management system with appropriate access controls.
  • To set, update, or remove supervisor credentials in a device's firmware, a device restart by a device user or another application is required. The Secure Endpoint Agent does not force a restart.
  • You can't cancel a Manage Supervisor Credentials request after it's submitted.

The RSVC feature is supported on Lenovo ThinkPad, ThinkCentre, and ThinkStation devices manufactured in 2020 or later.

Certificate-based authentication is not supported on any models manufactured before 2022. For information about certificate support on specific Lenovo models, see the model's specifications in Lenovo documentation.

The following prerequisites must also be met:

To submit a Manage Supervisor Credentials request, your user role needs to be granted the Perform permission for Manage Supervisor Credentials. To view Supervisor Credentials status and version information in Device Details, your user role needs to be granted the Viewpermission for Manage Supervisor Credentials. The default System Administrator role is granted these permissions.

You can create a device report to view the current Remote Supervisor Credentials status of your devices. The status shows whether credentials are set, its type (password or certificate), and whether it was set locally or remotely.

To view Remote Supervisor Credentials status:

  1. From the navigation bar, open a report or page that shows a device list in the results grid. For example, click to open the Devices page.
  2. In the work area, use the search field or filters to find the devices you're interested in.

  3. Click > Edit Columns and add the following columns to the report or page:

    • Supervisor credentials > Status
    • Supervisor credentials > Version
  4. Add additional columns or report filters, as desired.
  5. [Optional] Save the report for future use.

  6. Review the values in the Supervisor credentials > Status column.

    Possible statuses are:

    Status Details
    Not set Supervisor credentials are not set on the device
    Password set locally

    A supervisor password was set locally on the device

    You must enter the current password to make changes from the console.
    Password set remotely

    A supervisor password was set using the RSVC feature

    You must enter the current password to make changes from the console.
    Password set remotely (no password required)

    A supervisor password was set using the RSVC feature

    You do not need to enter the password to makes changes from the console
    Certificate set locally

    A supervisor certificate was set locally on the device

    The current, trusted private key is required to make changes from the console.
    Certificate set remotely

    A supervisor certificate was uploaded and applied to the device using the RSVC feature

    The current, trusted private key is required to make changes from the console.

    If No data shows, the device is not eligible for the RSVC feature.

  7. Review the values in the Supervisor credentials > Version column. It shows the version number of the firmware's Remote Supervisor Credentials software.

    The version determines the type of credentials that are supported:

    Supervisor Credentials version Credentials requirement
    Version 3.0 and higher Supports standard passwords, strong passwords (if configured), or certificates
    Version 2.17 to 2.99

    Supports standard passwords, or strong passwords (if configured)
    Versions 2.0 to 2.16

    Supports standard passwords only
    Version 1.0

    Supports simple passwords only

    If No data shows, the device is not eligible for the RSVC feature.

    Learn more about password requirements

To manage supervisor certificates, you may need to generate keys, certificates, or signature files using OpenSSL before submitting your Manage Supervisor Credentials request. If OpenSSL is not installed, download a suitable OpenSSL distribution and install it to a working directory of your choice.

For Windows, a list of third-party binary distributions is available at https://github.com/openssl/openssl/wiki/Binaries. Alternatively, you can build OpenSSL from the source code.

Steps for running the required OpenSSL commands are provided in each applicable section below.

A supervisor certificate is a trusted digital certificate (X.509) that is stored in a device's firmware. It lets an administrator that holds the certificate's corresponding private key access UEFI/BIOS settings without typing a password. Certificates offer stronger security than passwords and are easier to manage at scale.

For more information about certificate authentication, see Certificate-based BIOS Authentication in Lenovo documentation.

To add or update a supervisor certificate on your Lenovo devices that support certificates, you need to generate a certificate file from a private key. The certificate is then uploaded to the Secure Endpoint Console in a Manage Supervisor Credentials request. When the request is processed on the device, the certificate is enrolled in the device's BIOS.

This task consists of the following steps:

To generate a certificate:

  1. If OpenSSL is not installed, download the latest version and install it.
  2. Open a Command Prompt as an administrator.
  3. Navigate to the OpenSSL executable (openssl.exe), which is typically located in the bin folder. This will be your working directory.
  4. Do the following to generate a certificate (.pem file):

    1. Run the following command to generate a private key:

      Copy
      openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out privateKey.pem

    2. Run the following command to create a Certificate Signing Request (req.csr) file in X509 format:

      Copy
      openssl req -new -key privateKey.pem -subj "/CN=<company name>/" -out req.csr

      where <company name> is the name of your organization.

    3. Run the following command to generate a certificate:

      Copy
      openssl x509 -req -in req.csr -signkey privateKey.pem -days 3650 -sha256 -out certificate.pem

    The privateKey.pem and certificate.pem files are added to your working directory. In the next section, you will upload the generated certificate.pem file to the console.

  5. Save the privateKey.pem and certificate.pem files to a secure location.

    The private key and certificate are not stored in the console for future use or reference. You are responsible for saving them to a secure, centralized secret management system with appropriate access controls.

To submit a request:

  1. Log in to the Secure Endpoint Console as a user with the Perform permission for Manage Supervisor Credentials.

  2. Do one of the following:

    On the device's Device Details page, click > Manage supervisor credentials.

    If the action is grayed out, one of the following conditions applies:

    1. From the navigation bar, open a page or device report that supports the Manage supervisor credentials option. For example, click to open the Devices page.
    2. In the work area, use the search field or filters to find the applicable devices.
    3. In the results grid, select each device you want to include in the request. To select all devices, select the Select All checkbox in the result grid header. To select consecutive devices, select the first device and then hold down the Shift key and select the last device. You can select up to 10,000 devices. To remove all selections, click Clear all.
    4. Click > Manage supervisor credentials.

    Alternatively, you can upload a file of device identifiers and submit a request.

  3. The Manage supervisor credentials dialog opens. If any devices are not eligible for Manage Supervisor Credentials requests, a banner showing the count of ineligible devices shows. For more information about eligibility, see eligibility requirements.

    To proceed with the eligible devices, click Configure supervisor certificate.

  4. If the Authenticate devices dialog shows, one or more devices require current supervisor credentials to apply a new signing certificate. Depending on the devices' supervisor credentials configuration, one or more of the following options may show:

    To view a device's detected version and status, add the Supervisor Credentials columns to a device report. Learn more

    • Include devices that require signature authentication

      The devices' detected version is 3.0 or higher. The current, trusted private key is required to authenticate the devices.

      1. Leave the checkbox selected.
      2. If OpenSSL is not installed, download the latest version and install it.
      3. Open a Command Prompt as an administrator.
      4. Navigate to the OpenSSL executable (openssl.exe), which is typically located in the bin folder. This will be your working directory.
      5. Add the current, trusted private key and the new certificate file to the working directory.

      6. Run the following command to create a digital signature of the private key:

        Copy 
        openssl dgst -sha256 -sign <private key> -out cert_change.sig certificate.pem

        where <private key> is the file name of the private key and certificate.pem is the new certificate file.

      7. Upload the signature file (cert_change.sig) to the console by browsing to its location and selecting it, or by dragging it into the dialog.

    To omit devices from your request, clear the applicable checkbox.

  5. Click Proceed on <#> devices.

  6. Upload the new certificate file to the console by browsing to its location and selecting it, or by dragging it into the dialog. Only .pem files are supported.
  7. Select the checkbox next to I understand that Absolute is not responsible for storing the supervisor credentials used on these devices to acknowledge that credentials are not stored in the Secure Endpoint Console.

  8. Click Run on <#> devices.

  • If the Daily action threshold reached dialog shows, the number of devices included in the request exceeds the daily threshold configured and enabled for this action. Learn more

  • If the request can't be processed on some devices due to ineligibility, a notification shows in the top right of the window soon after submitting the request. Click View progress in the notification to view the status of each device on the Action Requests page. If all devices are ineligible, click View devices to review each device's failure reason.

The request is submitted, its Action status is set to Pending, and a Supervisor Configuration requested event is logged to Event History. The request is deployed to each device on its next successful connection to the Absolute Monitoring Center, which is typically within a few minutes for Absolute Resilience accounts, or within 15 minutes for Absolute Control accounts, assuming the devices are online.

The certificate is not set until the device is restarted. At that time, the device's Supervisor Credential Status Indicates whether the firmware's supervisor password (or certificate) on a device has been set remotely in the Secure Endpoint Console. Possible values are: Not Set, Password set locally, Password set remotely, Password set remotely (no password required), Certificate set locally, and Certificate set remotely. The field applies to select Windows devices only. is updated to Certificate set remotely.

To track the progress of your request, see Action History.

Removing the supervisor certificate leaves the device unsecured. Anyone with physical access to the device will have full access to its BIOS settings and configurations. Consider replacing the certificate with a password.

You can remove a supervisor certificate from a device. To remove the certificate from a device, you need to generate a signature file using the device's serial number and upload it to the console. The file is then uploaded to the Secure Endpoint Console in the Manage Supervisor Credentials request.

Remove Supervisor Certificate requests can contain only one device. If you select multiple devices in a device report, the Remove supervisor certificate option is not available.

This task consists of the following steps:

To generate a signature file for a device:

  1. If OpenSSL is not installed, download the latest version and install it.
  2. Open a Command Prompt as an administrator.
  3. Navigate to the OpenSSL executable (openssl.exe), which is typically located in the bin folder. This will be your working directory.
  4. Go to the device's Device Details page and copy the device's serial number.

  5. Create a text file and add the serial number to the file.

    Ensure that the file contains a single serial number without a CRLF line terminator (CR 0x0D followed by LF 0x0A). No additional characters or lines are permitted.

  6. Save the file as serial.bin to the working directory.
  7. Add the current, trusted private key to the working directory.

  8. Run the following command to generate a signature file:

    Copy 
    openssl dgst -sha256 -sign <private key> -out cert_remove.sig serial.bin

    where <private key> is the file name of the private key.

The cert_remove.sig file is added to your working directory. In the next section, you will upload this file to the console.

To submit a request to remove a device's supervisor certificate:

  1. Log in to the Secure Endpoint Console as a user with the Perform permission for Manage Supervisor Credentials.
  2. Navigate to a page that shows linked Identifiers in the results grid, such as a report, device group, or folder.
  3. In the results grid, click the Identifier of the applicable device. The Device Details page opens.
  4. Click > Manage supervisor credentials.

  5. The Manage supervisor credentials dialog opens. If the device is not eligible for this action, a banner shows. For more information about eligibility, see eligibility requirements.

    Click Remove supervisor certificate.

    If the Remove supervisor certificate is grayed out, but the Remove supervisor password option is available, a supervisor password is set on the device. To remove it, see Removing a supervisor password.

  6. Click Browse files and browse to the location of the cert_remove.sig file you generated and select it. Alternatively, drag the file into the dialog.

  7. Click Proceed on 1 device.
  8. Review the warning and carefully consider if you want to proceed with removing the devices' supervisor certificate.
  9. Select the checkbox to acknowledge the security risks associated with this action, and then click Run on 1 device.

  • If the Daily action threshold reached dialog shows, the number of devices included in the request exceeds the daily threshold configured and enabled for this action. Learn more

  • If the request can't be processed on some devices due to ineligibility, a notification shows in the top right of the window soon after submitting the request. Click View progress in the notification to view the status of each device on the Action Requests page. If all devices are ineligible, click View devices to review each device's failure reason.

The request is submitted, its Action status is set to Pending, and a Supervisor Configuration Removal requested event is logged to Event History. The request is deployed to each device on its next successful connection to the Absolute Monitoring Center, which is typically within a few minutes for Absolute Resilience accounts, or within 15 minutes for Absolute Control accounts, assuming the devices are online.

The certificate is not removed until the device is restarted. At that time, the device's Supervisor Credential Status Indicates whether the firmware's supervisor password (or certificate) on a device has been set remotely in the Secure Endpoint Console. Possible values are: Not Set, Password set locally, Password set remotely, Password set remotely (no password required), Certificate set locally, and Certificate set remotely. The field applies to select Windows devices only. is updated to Not set.

To track the progress of your request, see Action History.

You can set or update the supervisor password on supported Windows devices.

To submit a request:

  1. Log in to the Secure Endpoint Console as a user with the Perform permission for Manage Supervisor Credentials.

  2. Do one of the following:

    On the device's Device Details page, click > Manage supervisor credentials.

    If the action is grayed out, one of the following conditions applies:

    1. From the navigation bar, open a page or device report that supports the Manage supervisor credentials option. For example, click to open the Devices page.
    2. In the work area, use the search field or filters to find the applicable devices.
    3. In the results grid, select each device you want to include in the request. To select all devices, select the Select All checkbox in the result grid header. To select consecutive devices, select the first device and then hold down the Shift key and select the last device. You can select up to 10,000 devices. To remove all selections, click Clear all.
    4. Click > Manage supervisor credentials.

    Alternatively, you can upload a file of device identifiers and submit a request.

  3. The Manage supervisor credentials dialog opens. If any devices are not eligible for Manage Supervisor Credentials requests, a banner showing the count of ineligible devices shows. For more information about eligibility, see eligibility requirements.

    To proceed with the eligible devices, click Configure supervisor password.

  4. If the Authenticate devices dialog shows, one or more devices require current supervisor credentials to set a new password. Depending on the devices' supervisor credentials configuration, one or more of the following options may show:

    To view a device's current supervisor credentials configuration, add the Supervisor Credentials columns to a device report. Learn more

    • Include devices that require signature authentication

      The devices' detected version is 3.0 or higher. The current, trusted private key is required to authenticate the devices.

      1. Leave the checkbox selected.
      2. If OpenSSL is not installed, download and install it.
      3. Open a Command Prompt as an administrator.
      4. Navigate to the OpenSSL executable (openssl.exe), which is typically located in the bin folder. This will be your working directory.

      5. Create a password file:

        1. Open PowerShell and navigate to the working directory.

        2. Run the following command, replacing <password> with the supervisor password you want to set.

          Copy 
          $pwBytes = [Text.Encoding]::ASCII.GetBytes("<password>")

          The password must meet the following requirements:

          • Alphanumeric characters (uppercase and lowercase)

          • Special characters (ASCII only)

          • 1 to 128 characters in length

        3. Run each of the following commands individually, pressing Enter after each line:

          Copy 
          $buf = New-Object byte[] 128
          Copy 
          [Array]::Copy($pwBytes, $buf, $pwBytes.Length)
          Copy 
          Set-Content password_padded_128b.bin -Value $buf -Encoding Byte

          The password_padded_128b.bin file is saved to your working directory.

      6. Copy the current, trusted certificate (certificate.pem) file to the working directory.

      7. In the Command Prompt window, generate a signature file by running each of the following commands individually, pressing Enter after each command:

        Copy 
        openssl dgst -sha384 -binary certificate.pem > MsgA_sha384.bin
        Copy 
        openssl dgst -sha256 -binary password_padded_128b.bin > MsgB_sha256.bin
        Copy 
        copy /b MsgA_sha384.bin + MsgB_sha256.bin MsgC_concat.bin
        Copy 
        openssl dgst -sha256 -sign privateKey.pem -out MsgC_concat_sha256.bin MsgC_concat.bin
        Copy 
        copy /b MsgC_concat_sha256.bin + MsgB_sha256.bin cert_change_pswd.sig

        The cert_change_pswd.sig signature file is added to your working directory.

      8. Upload the signature file to the console by browsing to its location and selecting it, or by dragging it into the dialog.

    To omit devices from your request, clear the applicable checkbox.

  5. Click Proceed on <#> devices.

  6. On the New supervisor password page, enter and confirm the new password in the applicable fields.

    In most cases, a standard password is required.

    • Alphanumeric characters (uppercase and lowercase)

    • Special characters (ASCII only)

    • 1 to 128 characters in length

    However, if the following banner shows, Version 1.0 of the Remote Supervisor Credentials feature is detected on one or more devices and a simple password is required:

    x of y devices are using an older BIOS version, and require a simple password format

    • Lowercase alphanumeric or space characters only

    • 1 to 64 characters in length

    Strong password requirements

  7. Select the checkbox next to I understand that Absolute is not responsible for storing the supervisor credentials used on these devices to acknowledge that credentials are not stored in the Secure Endpoint Console.
  8. Click Run on <#> devices.

  • If the Daily action threshold reached dialog shows, the number of devices included in the request exceeds the daily threshold configured and enabled for this action. Learn more

  • If the request can't be processed on some devices due to ineligibility, a notification shows in the top right of the window soon after submitting the request. Click View progress in the notification to view the status of each device on the Action Requests page. If all devices are ineligible, click View devices to review each device's failure reason.

The request is submitted, its action status is set to Pending, and a Supervisor Configuration requested event is logged to Event History. The request is deployed to each device on its next successful connection to the Absolute Monitoring Center, which is typically within a few minutes for Absolute Resilience accounts, or within 15 minutes for Absolute Control accounts, assuming the devices are online.

The password is not set until the device is restarted. At that time, the device's Supervisor Credential Status Indicates whether the firmware's supervisor password (or certificate) on a device has been set remotely in the Secure Endpoint Console. Possible values are: Not Set, Password set locally, Password set remotely, Password set remotely (no password required), Certificate set locally, and Certificate set remotely. The field applies to select Windows devices only. is updated to Password set remotely.

To track the progress of your request, see Action History.

If one or more actions show a Failed status on the Actions page, and Device requires a strong password format shows in the Status details column, submit a new Manage Supervisor Credentials request, specifying a strong password in the password field.

Strong password requirements:

  • At least one uppercase character

  • At least one lowercase character

  • At least one number

  • 8 to 128 characters in length

Strong passwords can also contain special characters (ASCII only), but it not a requirement.

To submit a request to remove the supervisor password:

  1. Log in to the Secure Endpoint Console as a user with the Perform permission for Manage Supervisor Credentials.

  2. Do one of the following:

    1. Navigate to a page that shows linked Identifiers in the results grid, such as a report, device group, or folder.
    2. In the results grid, click the Identifier of the applicable device. The Device Details page opens.
    3. Click > Manage supervisor credentials.
    1. From the navigation bar, open a device group or folder, or open a device report that supports the Manage supervisor credentials option. For example, click to open the Devices page.
    2. In the work area, use the search field or filters to find the applicable devices.

    3. In the results grid, select the checkbox next to each device you want to include in the request. To select all devices, select the Select All checkbox in the result grid's header. You can select up to 10,000 devices.

    4. Click > Manage supervisor credentials.

    Alternatively, you can upload a file of device identifiers and submit a request.

  3. The Manage supervisor credentials dialog opens. If any devices are not eligible for Manage Supervisor Credentials requests, a banner showing the count of ineligible devices shows. For more information about eligibility, see eligibility requirements.

    To proceed with the eligible devices, click Remove supervisor password.

    If the Remove supervisor password option is grayed out, but the Remove supervisor certificate option is available, a supervisor certificate is set on the devices. To remove it, see Removing a supervisor certificate.

  4. If the Authenticate devices dialog shows, one or more devices require authentication using the devices' current supervisor password. Depending on the devices' supervisor credentials configuration, one or both of the following options may show:

    To omit devices from your request, clear the applicable checkbox.

  5. Click Proceed on <#> devices.
  6. Review the warning and carefully consider if you want to proceed with removing the devices' supervisor password.
  7. Select the checkbox to acknowledge the security risks associated with this action, and then click Run on <#> devices.

  • If the Daily action threshold reached dialog shows, the number of devices included in the request exceeds the daily threshold configured and enabled for this action. Learn more

  • If the request can't be processed on some devices due to ineligibility, a notification shows in the top right of the window soon after submitting the request. Click View progress in the notification to view the status of each device on the Action Requests page. If all devices are ineligible, click View devices to review each device's failure reason.

The request is submitted, its Action status is set to Pending, and a Supervisor Configuration Removal requested event is logged to Event History. The request is deployed to each device on its next successful connection to the Absolute Monitoring Center, which is typically within a few minutes for Absolute Resilience accounts, or within 15 minutes for Absolute Control accounts, assuming the devices are online.

The password is not removed until the device is restarted. At that time, the device's Supervisor Credential Status Indicates whether the firmware's supervisor password (or certificate) on a device has been set remotely in the Secure Endpoint Console. Possible values are: Not Set, Password set locally, Password set remotely, Password set remotely (no password required), Certificate set locally, and Certificate set remotely. The field applies to select Windows devices only. is updated to Not set.

To track the progress of your request, see Action History.