7 BIOS checks that reveal whether a used laptop is actually a deal

The moment you pay for a used device, you may be inheriting some real problems. The BIOS is one of the places you want to investigate critically because it’s the part that a reseller can’t easily clean up. By running these checks, you’ll find out what the seller may be hiding, or what they don’t already know about the laptop.

Check the Absolute/Computrace status

Someone else can still lock or wipe this laptop

On most laptops, the BIOS has a feature called Absolute (sometimes listed as Computrace), under Security or Anti-Theft. You’re not just checking whether the feature is present, but whether it has been activated. This feature can exist in three distinct states:

When Absolute/Computrace is activated, that device can be wiped or locked at will from a remote server. Even if you reinstall the OS, you wouldn’t be able to change this control. It lives in the UEFI firmware and outlives SSD swaps and certain hardware-level repairs. You must walk away if the laptop seller can’t deactivate it on the spot.

Test the BIOS supervisor lock — don’t just look for it

If you can’t change a setting, you don’t own the laptop

Credit: ASRock

The goal isn’t to find a lock label but to test it. You can change the boot order or toggle any of the security settings. If, after doing so, a password is required, make sure the seller can clear it before proceeding with the purchase. When the BIOS remains locked, it will be difficult to perform a clean OS install or apply firmware updates.

Enterprise machines typically store the supervisor lock in the embedded controller chip rather than the CMOS, which means that even battery pulls and hard resets can’t clear it. And even though a CMOS reset would work on certain consumer-grade machines, don’t simply assume it.

A locked BIOS puts a fixed limit on anything that machine can do under your ownership.

Verify Intel AMT / vPro provisioning state

Remote access that operates below your operating system

This point is often missed by buyers. Intel AMT is part of the vPro platform. This hardware management layer doesn’t operate within the limits of the firewall or security software you install. You can find it in the MEBx menu under Advanced -> Network. It may exist as Unprovisioned or Provisioned.

If it’s provisioned, as long as the computer is connected to power and a network, a remote admin can turn the machine off or on, and may even access its screen and redirect storage. This access is active, and the OS has no visibility into it.

This check matters most on laptops that come from a corporate environment; consumer models typically don’t carry vPro.

Inspect Secure Boot key ownership

The problem that only shows itself when something breaks

It’s not a problem if Secure Boot is enabled, but you should be concerned about who enrolled the keys. If you are buying a used standard consumer machine, you’d be able to toggle Secure Boot on or off without restriction because Microsoft’s keys are loaded by default.

However, it’s a different case on a corporate-configured machine, where enterprise certificates take the place of Microsoft’s keys, with the system locked in Deployed Mode. You will need the supervisor password to enter the setup to re-enroll or reset keys.

If you buy a laptop that has this restriction, dual-boot setups will not work, and it will not be possible to install Linux. The worst part is that you will not get any clear errors when the installation fails. For some people, this will not be a deal-breaker, but you still will not be using the machine freely.

Confirm TPM 2.0 status and ownership state

This determines how long the laptop actually stays viable

With Windows 10 reaching its end of life, you may already run into some friction if the computer can’t easily run Windows 11. The availability of TPM 2.0 is a necessary hardware eligibility requirement for Windows 11. However, it’s not enough to see this feature listed in your BIOS. You need it to be present, enabled, and showing as Ready or Available.

If you are about to purchase a 7th or 8th-generation Intel machine, be careful because certain enterprise-grade versions shipped with TPM permanently disabled at the hardware level, and no BIOS switch can fix this.

It’s also important to check the Owned by Organization state. It indicates whether BitLocker encryption keys are held by domains you don’t control or cannot access. This may limit how much access you have to the drive.

Check storage Power-On Hours and run the self-test

The number a seller cannot reset

This test reads an odometer that shows how much the drive has actually been powered on. This counter isn’t reset when the computer is reset or when the OS is reinstalled (clean install). You can run the test from BIOS diagnostics, looking for Power-On Hours.

You may also use CrystalDiskInfo from a USB drive if your BIOS doesn’t surface this detail. Once you have the data, the table below shows how to interpret it:

OS

Wiindows

Price model

Free

CrystalDiskInfo is an open-source software for Windows. It monitors the health, temperature, and S.M.A.R.T. status of HDDs and SSDs and provides warnings before potential disk failures.

Cross-check battery wear against cycle count

Both numbers together tell you what you’re actually buying

You can view cycle count in the BIOS under Power or Battery. Here’s how to interpret this combination:

This number, however, is not an absolute reading but rather a strong signal, as a third-party replacement battery can show inaccurate wear figures. This check is more of a negotiating lever than an absolute reason to walk away.

Quick BIOS reference before you buy

The table below summarizes the actions I recommend based on each check.

A good price tag doesn’t always mean you got a good deal. If you’re locked out of important parts of the laptop, you may end up getting only part of the value you paid for. These BIOS checks should be your starting point before making a final decision.