Hello!
I’m trying to reset the “password retry count” on my ThinkPad X250 so I no longer get the “0199 system security - security password retry count exceeded error” on startup that is preventing me from entering the BIOS and Operating system.
The machine has a Supervisor password which I don’t know. (I bought it this way). I only want to reset that counter so I can at least use my laptop.
Does anyone know how to patch my bios dump in order to reset that thing, or what should I modify in the .bin file?
I tried to replace different blocks of memory from another X250 bios dump witch didn’t had that problem. The 0199 error dissappeared but instead I got “0183 bad crc of security settings in efi variable” and I couldn’t acces the BIOS or Windows.
Again, I’m not trying to remove the supervisor password, only to reset that counter so I no longer get the 0199 error.
Here is my bios dump if you want to take a look: https://www.dropbox.com/s/0qyqdnakn7fsvcs/bios1.zip?dl=0
If somebody could please help me, it’ll be great.
Thank you!
@Lost_N_BIOS do you have any idea how to solve this problem, please? I saw you are the expert around here.
Thank you for the answer but it does not help because on newer ThinkPads, the password is no longer kept in EEPROP. It’s stored in a separate chip.
But as I was explaining, I don’t want to remove the password because it’s very hard. I only want to reset the “password retry count” so I can use the laptop.
@Marian97 - how are you dumping and flashing the mod BIOS? Can you please upload that BIOS to another file host, not Mega.NZ either, I can’t download from dropbox or mega all month long
The above linked method should still work too, even if password is stored in another chip, once done enter BIOS and load defaults.
Hard clear of CMOS would do the same too, reset BIOS and put it in either fail safe or optimized defaults, whatever is the default after a BIOS flash, and that would reset the counter too.
If there is no clear CMOS Pins, remove main power cable, remove main battery, remove CMOS battery, then press and hold the power on button for one minute.
Sometimes this doesn’t work, but worth trying, also worth trying leaving in this no power state overnight or while you are gone all day etc
@Lost_N_BIOS thank you for your answer!
I’ve done the dump using a Ch341a programmer. I’ve uploaded it to we-transfer. Hope that works. If not, let me know.
https://we.tl/t-5vqVqqLsth
I’m gonna try to do what’s in that link to see if I get a result.
I tried to reset the CMOS using the reset button on-board and besides the usual 0199 error I also get an error saying the bios was reset that goes away after one reboot.
Is this kind if CMOS reset different from tbe F9 load default setting?
Also I had removed the CMOS battery for more than 5 minutes but this also did nothing regarding the password retry count exceeded error.
Do you think cleaning the ME region would reset that counter?
Thank you again!
-----------------
Also, the BIOS chip is an SPI chip, not I2C. What data pins I should short circuit with the clock pin?
The chip is a winbond w25q128, you have a picture below with the datasheet.
https://imgur.com/a/7IluSCl
Thanks, good to know it’s programmer dumped. Yes, Clear CMOS reset by button is different than loading defaults, if you don’t load defaults after clear CMOS then you are on fail safe settings.
Also, there is soft clear of CMOS and hard, and hard clear is more what I mentioned, which some systems it doesn’t work on while others it will. Either one, you’d want to load optimal defaults after you clear the CMOS.
All BIOS is SPI chip. Sorry, I don’t know about that guided method, I assume you follow that guide and lookup your chips PDF if need be, as you’ve done above.
Maybe @maks has used, can advise etc.
I got the file, thanks, inspecting and will update once I can say something more.
* Edit @Marian97 - Please download ME System Tools V10 from section “C” in this page
Intel Management Engine: Drivers, Firmware & System Tools
Inside, find the MEInfo folder, inside that find the win or Win32 folder, select that folder, hold shift and press right click, choose open command window here (Not powershell)
Then run this command and show me only the end portion of output >> MEInfoWin.exe -verbose
We are looking at Measured & Verified boot, on the left/FPF side, do you see enabled for either, only the Left/FPF side?
* Edit - Password at restart can be disabled, but I don’t know the outcome of that once a password is set.
Power on password can’t be disable/enabled, only set or not, so this probably the only one that matters here, aside from what you want changed
This is what you wanted I believe, this can be set >> Max Password Attempts
Can be set to one of the following, I assume you want unlimited, correct?
One Of Option: 1, Value (8 bit): 0x1 {09 1C DD 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
One Of Option: 3, Value (8 bit): 0x2 {09 1C DE 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
One Of Option: 100, Value (8 bit): 0x3 {09 1C DF 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
One Of Option: Unlimited, Value (8 bit): 0x0 {09 1C E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
Thank you very much for your reply. I’m glad someone on the internet wants to help.
You told me to download and run ME System Tools V10.
I think you want me to run it on the laptop I’m having trouble with from what I understand?
I can’t enter in the BIOS or Windows. When I power it up I get the following screen with the 0199 error. I press F1 and it takes me to the next screen where I’m prompted to enter the password. Just hitting enter without any password typed in doesn’t enter the limited access BIOS like it usually does when you don’t exceed the password retry count . (pictures in the link below)
https://m.imgur.com/a/Y2a2Up1
I’m sorry if you understood it already and I explained it again.
About what you found, I think Max Password Attempts has to do with Password Retry Count but I’m not sure if setting it to Unlimited also resets the counter.
Of course I wil try it, but I don’t know at what offset I should replace it in the bios dump.
Do you happen to know?
And about that guide with the short circuit of the SCL and SDA pins. @maks my BIOS chip isba Winbond W25q128. The clock pin is obvious, but what data pin I should short circuit it with?
Thank you guys again!
Can you tell me how to do any of these things? Where in the bios dump I need to modify?
Thank you again!
@Marian97 - sorry about that, I guess I wasn’t thinking about you not being able to enter windows. Please see if you can run DOS from USB, if so then copy all contents from the DOS folder to a bootable USB Stick and run it from there.
As for changing the setting, yes, I think that would reset it, or if not and the count remains, once changed to unlimited then that saved attempt count shouldn’t matter.
I would make the edit for you on the BIOS dump once we confirm if you have boot guard enabled or not first.
@Lost_N_BIOS thank you for helping me!
I managed to unlock the bios about two weeks ago. Of course, not with my knowledge, someone else helped me.
I’m glad people like him and you are still willing to help people on those forums.
If I’m gonna have any problems, this is the forum where I will go. Thank you!
You’re welcome! Sorry I wasn’t able to help you in time, but I’m glad to see you did find help from someone 
So what did you end up having them do, did they send you some other BIOS, or edit some of the above in your current BIOS?
I have an x250 with the same problem
How did you unlock it?
I got some dxe drivers which I injected in my bios dump. Like “all service” does.
I don’t know if it will work on other machines, but on my X250 it worked.
@Marian97 - can you send me that in PM so I can inspect and see if it helps me figure anything out for others. Thanks!