Security

This chapter provides information about how to protect your computer from theft and unauthorized use.

Using passwords

Attaching a mechanical lock

Computer security

Setting the security chip


Attaching a mechanical lock

You can attach a mechanical lock to your computer, to help prevent it from being removed without your permission.

Attach a mechanical lock to the keyhole of the computer; then secure the chain on the lock to a stationary object. Refer to the instructions shipped with the mechanical lock.

Note: You are responsible for evaluating, selecting, and implementing the locking devices and security features. IBM makes no comments, judgments, or warranties about the function, quality, or performance of locking devices and security features.


Hard disk passwords

Two types of hard disk passwords help protect the information stored on the hard disk.

  • User hard disk password

  • Master hard disk password, which requires a user hard disk password

When a user hard disk password is set, but no master hard disk password is set, no one can get access to files and applications on the hard disk without first typing that password.

The master password can be set and used only by a systems administrator. Like a master key, it enables the administrator to get access to any hard drive in a system. The administrator sets the master password; no one else knows it. Then the administrator sets a user password for each computer in the network, and tells each user the password for his or her computer. The user can then change the user password as desired, but the administrator can still get access by using the master password.

To set a hard disk password:

  1. Print these instructions.
  2. Save all open files, and exit all applications
  3. Click Start-->Shut Down-->Shutdown. When the computer turns off, turn it on again.
  4. As soon as the IBM ThinkPad opening screen opens, press F1. After several seconds, the BIOS Setup Utility screen opens.
  5. Select Password, using the cursor directional keys to move down the menu.
  6. Select Hard Disk x Password, where x is the letter of the hard disk drive for which you want to set a password.
  7. A password window opens. You are prompted to select User only or Master + User. Select User if you want to set only one hard-disk password. If you are an administrator or supervisor, you can select Master + User to set two passwords. (The user can change the user password later.)
  8. If you select Master + User, go to step 11.
  9. If you select User only, a new-password window opens. Choose a user hard disk password, which can be from one to seven characters in any combination. Type it in the Enter New Password field.
  10. Press the down arrow key once to move to the next line. Retype the password you just entered, to verify it. Go to step 17 to complete the procedure.
  11. If you select Master + User, a message window opens and prompts you to set up a user hard disk password first. Select Continue.
  12. A new hard disk user password window opens. Choose the user password you want, which can be from one to seven characters in any combination. Type it in the Enter New Password field.
  13. Press the Enter key once to move to the next line. Retype the password you just entered, to verify it.
  14. A message window opens and prompts you to set the master hard disk password. Select Continue.
  15. A new master hard-disk window opens. Choose the master hard disk password you want, which can be from one to seven characters in any combination. Type it in the Enter New Password field.
  16. Press the Enter key once to move to the next line. Retype the password you just entered, to verify it.
  17. Commit any password to memory.
    18. Attention: You might want to note your passwords and keep them in a safe place. If you forget the user-only password, or both user and master passwords, IBM will not reset your passwords or recover data from the hard disk. You must take your computer to an IBM reseller or an IBM marketing representative to have the hard disk drive replaced. Proof of purchase is required, and an additional charge might be required for the service.
  18. Press F10 to exit. Select Yes in the Setup Confirmation window.

The next time you turn on your computer, you will have to type the user or master hard disk password in order to start your computer and get access to your operating system.

Changing or removing the User only hard disk password

To change a User only hard disk password, follow these steps:

  1. Follow steps 1 through 7 above, typing your password to get access to the BIOS Setup Utility program.
  2. Select the User only option.
  3. In the Enter New Password field, type the new password; then retype it to verify.

To remove the User only hard disk password, follow these steps:

  1. Follow steps 1 and 2 above.
  2. Leave the Enter New Password field blank.
  3. Press Enter twice.

Changing or removing the User + Master hard disk password

  1. Print these instructions.
  2. Save all open files, and exit all applications.
  3. Click Start-->Shut Down-->Shutdown . When the computer turns off, turn it on again.
  4. When the IBM ThinkPad opening screen opens, press F1. After several seconds, the BIOS Setup Utility screen opens.
  5. Select Password, using the cursor directional keys to move down the menu.
  6. Select Hard Disk x Password, where x is the letter of the hard disk drive for which you want to set a password.
  7. A password window opens. You are prompted to select User HDP or Master HDP.
  8. If you choose User HDP, do one of the following:
    • To change the password, type the current user hard disk password or the current master hard disk password. Then type the new password, and retype it to verify it.
    • To delete the password, type the current master hard disk password, then press Enter twice. Both user and master passwords will be removed.
  9. If you choose Master HDP, do one of the following:
    • To change the password, type the current master hard disk password. Then type the new password, and retype it to verify it.
    • To delete the password, type the current master hard disk password, and then press Enter twice. Both user and master passwords will be removed.


Passwords and standby mode

If you have set passwords and you put your computer into standby mode by pressing Fn+F4, the procedure for resuming operation is as follows:

  • If you have set the power-on password, or both the power-on password and the supervisor password, then when you press the Fn key to resume operation, you will be prompted to type the power-on password. (If you have set both the power-on password and the supervisor password, you can enter the supervisor password instead of the power-on password.)

    Note: If you are using Windows(R) XP or Windows 2000 (ACPI operating system), you will not be prompted to type the password when resuming operation.

  • If any hard disk has a hard disk password, it is unlocked automatically when you resume operation.

If you use a hard disk password with your computer in a docking station, follow these procedures to ensure smooth docking and undocking:

  • If you dock your computer to the docking station while the computer is running, make sure that it is in standby mode. (Press Fn+F4 to put it in standby.)

  • To resume operation, press the Fn key and type the passwords as you are prompted.

Note: If your computer is running, do not attach it to a docking station without first putting it in standby mode. If you do, you will be unable to access the password-protected hard disk in the docking station.


Power-on password

You can set a power-on password to help protect your ThinkPad(R) computer against access by unauthorized users.

If you set a power-on password, the password prompt appears on the screen whenever you turn on the computer. You must enter the correct password to start using the computer.

To set a power-on password:

  1. Print these instructions.
  2. Save all open files, and exit all applications.
  3. Click Start-->Shut Down-->Shutdown. When the computer turns off, turn it on again.
  4. As soon as the IBM ThinkPad opening screen opens, press F1. After several seconds, the BIOS Setup Utility screen opens.
  5. Select Password, using the cursor directional keys to move down the menu.
  6. Select Power-on Password.
  7. Choose your power-on password, which can be from one to seven characters in any combination. Type it within the brackets on the Enter New Password field.
  8. Press the Enter key once to move to the next line. Retype the password you just entered, to verify it.
  9. Commit your password to memory.
    10. Note: You might want to note your power-on password in a safe place. Otherwise, if you forget it, you have to take your computer to an IBM reseller or a marketing representative to have the password canceled.
  10. Press F10 to exit.
  11. Select Yes in the Setup Confirmation window.

Changing or removing the power-on password

To change the power-on password, follow the steps 1 through 6. Enter your current password. When the Enter New Password field opens, type a new password in the field and then retype it to verify. To remove the password, follow steps 1 through 6. Type your current password. When the Enter New Password field opens, leave it blank and press Enter twice.


Setting the security chip

Depending on the options you ordered, your ThinkPad computer might have an embedded security chip. With the IBM Security Chip and the IBM Client Security Software, you can do the following:

  • Protect your data

  • Strengthen access controls

  • Secure communications

To use the IBM Client Security Software, download it from the following Web site:

http://www.pc.ibm.com/ww/ibmpc/security/secdownload.html

You can also download the administrator's guide for the IBM Client Security Software from this site.

Setting the security chip

The choices offered in the IBM Security Chip submenu under the Config menu of the IBM BIOS Setup Utility are as follows:

  • IBM Security Chip: Enables or disables the Security Chip.

  • Clear IBM Security Chip: Clears the Security Chip password and encryption key.

To set an item in the IBM Security Chip submenu:

  1. Print these instructions. To set the security chip, you must turn your computer off and then on again.
  2. Save all open files, and exit all applications.
  3. Click Start-->Shut Down-->Shutdown. When the computer turns off, turn it on again.
  4. When the IBM ThinkPad opening screen opens, press F1. After several seconds the BIOS Utility screen opens.
  5. Using the cursor keys, move to Config, and press Enter. The Config menu opens.
  6. Using the cursor keys, move to IBM Security Chip, and press Enter. The IBM Security Chip submenu opens.
  7. Using the cursor keys, move to an item you want to set. When the item you want is highlighted, press Enter.
  8. Set the items you want to set. To change the value of an item, use the F5 or F6 key.
  9. Press F3 or Esc to exit from the submenu. Press Esc repeatedly until you reach the IBM BIOS Setup Utility menu.

After the security chip is enabled, you can set the security chip password from the IBM Client Security Software. To use the Security Chip feature, the Security Chip password should be set.


Security

Computer Security

The IBM Client Security Solutions Web site contains information about a variety of tools available to help you protect data, improve secure communications, and strengthen access-authentication processes that help ensure that only autorized personnel can access your computers and network.

To access the IBM Client Security Web site, make sure you have an active Internet connection, and then go to this Web site:

http://www.pc.ibm.com/ww/ibmpc/security/index.html


Supervisor password

The supervisor password protects the system information stored in the BIOS Setup Utility. Without it, no one can change the configuration of the computer. It provides the following security features:

  • If a supervisor password is set, a password prompt appears when you try to start the BIOS Setup Utility. Unauthorized users cannot get access to configuration data.

  • The system administrator can use the supervisor password to get access to a computer even if the user of that computer has set a power-on password. The supervisor password overrides the power-on password.

  • If both a supervisor password and a power-on password are set, you can do the following only if you have the supervisor password:

    • Changing the boot sequence

    • Deleting the power-on password

    • Changing or deleting the supervisor password

    • Enabling or disabling the Wake on LAN and Flash over LAN features

    • Changing date and time

    • Enabling or disabling the Lock BIOS Setting feature

    • Changing the setting for the IBM Security Chip

    • Enabling or disabling the Boot Device List F12 Option

    • Enabling or disabling the Flash BIOS Updating by End-Users feature

Note: The system administrator can set the same supervisor password on many ThinkPad computers to make administration easier.

Note: By enabling the Lock BIOS Settings in the Password menu when you set the supervisor password, you make it impossible for anyone but you to make changes.

To set a supervisor password:

Only a system administrator will be able to apply this procedure.

  1. Print these instructions.
  2. Save all open files, and exit all applications.
  3. Click Start-->Shut Down-->Shutdown. When the computer turns off, turn it on again.
  4. When the IBM ThinkPad opening screen opens, press F1. After several seconds the BIOS Utility screen opens.
  5. Select Password, using the cursor directional keys to move down the menu.
  6. Select Supervisor Password.
  7. A window opens that prompts you to enter a new password.
  8. Choose your supervisor password; it can be from one to seven characters in any combination. Type it in the Enter New Password field; then press Enter.
  9. Press the Enter key to move to the next line. Retype the password you just entered, to verify it.
  10. Commit your password to memory.
    11. Attention: You might want to note your password and keep it in a safe place. If you forget your supervisor password, IBM will not reset your password. You must take your computer to an IBM reseller or an IBM marketing representative to have the system board replaced. Proof of purchase is required, and an additional charge might be required for the service.
  1. Press F10 to exit. In the Setup Confirmation window, select Yes.

The next time you open the BIOS Setup Utility program, you will be prompted to type your password to proceed.

Changing or removing the supervisor password

To change or remove the supervisor password, do steps 1 to 3 from the procedure above.

To change the password, do the following:

  1. When the IBM ThinkPad opening screen opens, press F1. Type your password to get access to the BIOS Setup Utility program.
  2. Select Password, using the cursor directional keys to move down the menu.
  3. Select Supervisor Password.
  4. In the Enter Current Password field, type the current password.
  5. In the Enter New Password field, type the new password; then retype it to verify.

To remove the password, follow steps 1 and 4 above. Then, do the following.

  1. Leave the password field blank, and then press Enter.
  2. Press Enter again.


Using passwords

By using passwords, you can help prevent your computer from being used by others. Once you set a password, a prompt appears on the screen each time you power on the computer. Enter your password at the prompt. You cannot use the computer unless you type the correct password.

Make sure that only authorized individuals access your computer. Establishing different kinds of passwords requires that other possible users know the proper passwords in order to get access your computer or your data.

Click on the items below to find out more about passwords and how to use them to protect your ThinkPad computer.

Passwords and standby mode

Power-on password

Hard disk passwords

Supervisor password

Other passwords

Microsoft(R) operating systems provide special Windows passwords such as screen-saver, log-on or network password. For information on how to set, change, and use these passwords, refer to the user's guide or the online help for the operating system.