Every password you set inside Windows shares one quiet weakness: it only works if the machine actually boots into Windows. Walk up to an unprotected PC with a bootable USB drive, tap one key during startup, and you can load a completely different operating system that has never heard of those passwords and will happily hand over the files on the disk. The defense against that move doesn't live in the operating system at all. It lives one layer down, in the firmware, and it's controlled by BIOS/UEFI passwords.
CompTIA A+ Core 2 (220-1202) lists BIOS/UEFI passwords in the Security domain under workstation security options. The exam expects you to know the two password roles — supervisor and user — what each one actually protects, why firmware passwords matter for physical security, and just as importantly, what they cannot do. General password hygiene such as length, complexity, and expiration belongs to the separate Password Considerations article; this one stays focused on the firmware layer itself.
Firmware setup runs below the operating system, so the OS can't protect it
Before any operating system loads, the computer runs code stored on a chip on the motherboard. On older machines that firmware is the Basic Input/Output System (BIOS); on essentially all modern machines it's the Unified Extensible Firmware Interface (UEFI), which replaced BIOS while keeping the same job. The firmware initializes the hardware, decides which device to boot from, and then hands control to whatever bootloader it finds there. After decades of habit, the setup screen on a UEFI machine is still commonly called the BIOS, and for password purposes the exam treats the terms as interchangeable.
The firmware also exposes a setup utility — the screen reached by pressing a key like Delete, F2, or F10 during power-on. Inside it live settings that shape everything above them: boot order, Secure Boot, virtualization support, integrated devices, and the firmware passwords themselves.
Here's the part that makes this a security topic rather than just a hardware topic. The operating system's entire security model — accounts, permissions, audit logs — starts working only after the operating system loads. The firmware runs first, so its settings sit outside the reach of every OS control; Windows cannot stop someone from entering the setup utility, because Windows isn't running yet. If you want to protect the settings that decide how the machine boots, the protection has to come from the firmware itself. That protection is a password, and firmware gives you two distinct kinds.
The supervisor password locks the settings; the user password locks the boot
The two firmware password roles are tested directly, and candidates constantly mix them up, so anchor them now.
The supervisor password — some vendors call it the administrator or setup password — protects access to the firmware setup utility. With a supervisor password set, the machine still powers on and boots normally, but anyone who tries to enter setup gets a password prompt first. No password, no changes: boot order stays fixed, Secure Boot stays enabled, virtualization toggles stay put, and nobody can remove or change the passwords themselves. The computer remains fully usable; its configuration becomes read-only to everyone but the administrator.
The user password — often called a power-on or system password — gates booting itself. With a user password set, the machine stops almost immediately after power-on and demands the password before it will start any operating system from any device. No password, no boot. This is a blunter instrument: the whole machine refuses to run for anyone who doesn't know the secret.
| Aspect | Supervisor password | User password |
|---|---|---|
| Also called | Administrator or setup password | Power-on or system password |
| What it gates | Entering firmware setup and changing settings | Booting the machine at all |
| Machine still boots without it? | Yes — normal boot is unaffected | No — prompt appears at every power-on |
| Who is inconvenienced | Only people trying to change settings | Every user, at every startup |
| Typical use | Shared, public, or managed machines | High-security or theft-prone machines |
Vendors combine the two in slightly different ways. On most implementations, the supervisor password must be set before a user password can be, and the supervisor password can always unlock or remove the user password — a hierarchy that mirrors an administrator account sitting above a standard account. Some firmware also lets the supervisor decide what a user password holder may see in setup: nothing, a read-only view, or a small subset such as the clock. For the exam, keep the core pairing straight and don't overthink vendor variations: supervisor guards the settings, user guards the boot.
A memory hook for exam pressure: the supervisor supervises the configuration; the user must get past a prompt just to use the machine.
Without firmware protection, a USB stick defeats every OS password
To see why this objective sits in the Security domain, walk through the attack it exists to prevent.
An attacker gets physical access to a workstation — an unattended office, a public kiosk, a stolen laptop. The Windows login screen is in the way, but the attacker has no intention of logging into Windows. Instead they plug in a USB drive carrying a live Linux distribution or a preinstallation environment, reboot, and either pick the USB device from the one-time boot menu or enter setup and move USB to the top of the boot order. The machine obediently boots the attacker's operating system, which mounts the internal drive as just another disk. From there the attacker can copy files, reset the local administrator password with an offline tool, or plant malware that runs the next time the real OS starts.