Bypass Installer Lockout on PC5010 (DSC)

I have a co-worker that picked up an old DSC PC5010 alarm panel (for free, you can’t go wrong right…) and since I had fun writing about the Honeywell Lynx Touch Backdoor, I figured I’d give this a go and see what happens. The problem… the panel had installer lockout enabled.

dsc-pc5010-installer-lockout

You can tell when a panel has installer lockout enabled because you will hear a distinct 8-10 clicks from a relay when the panel is initially powered up (see video directly below). When the panel is locked out like that it blocks the ability to default the panel back to factory (even by hard wire reset), so unless you have the installer code, you’re SOL…

My panel is locked out, am I really SOL?

Maybe not. We actually have a tool at my workplace called “The Instant Unlocker” with the sole purpose to unlock panels. It consists of a device you place on top of the microcontroller on your panel which will allow it to “decode the installer code” and unlock your panel. The problem? This device isn’t cheap ($170USD for the starter kit) PLUS you need to purchase “unlock charges” at $35 per unlock (sheesh, everyone has their hands in your pockets these days)! So scratch, I’m too cheap to pay that much!

So what is option two?

Option two involved 3 names I stumbled on throughout forums. Apparently there is was only 3 people at one point (not including DSC themselves) that were capable of unlocking these panels. These days, I could only find 1 of those 3 people with an “active” website (I use the term “active” lightly, the site is hosted on a sympatico.ca subfolder and looked like it was made in the early 90s). That being said, the site has a HUGE amount of electronic security information on it, which is just awesome, feel free to check it out here. They charge $20 per board to unlock, which is reasonable. My problem with this place (aside from the outdated website) is they won’t do just 1 board, and have a MOQ of multiple boards to do unlocks for you.

OK so are you going to tell me how or what?

I’m sorry, I know I get carried away sometimes. The great news is, there’s an alternative to bypass installer lockout on the PC5010 (and possibly others) for FREE. Yes. FREE. All you need is a small piece of wire, and an IC clip.

ic-clip-with-wire

The PC5010 has a microcontroller made for DSC alarm panels (DSC R333200666V202). Now finding a pin out for that chip was near impossible. Though I stumbled upon some information that pin 25 on that IC is a data pin. Someone else claimed that grounding that data pin on power up will make the panel think that its brand new. To my understanding, this works by blocking the microcontroller from being able to read the EEPROM data on power up, therefore reverting to a “like new” state in which it’s not locked out and the installer code is reset to default (5010). I figured the panel was no good as it sits, so might as well give it a try.

The process is simple. Connect your IC clip to pin 25 on the DSC micro controller chip, and connect the other end into any of the common ports by your zones.

grounded-pin-25

Power up the panel (if it works, you should NOT hear the installer lockout clicking). Enter installer mode using the default code (*8 5010). This next part needs to be done fairly quickly. Disconnect the IC clip to allow the chip to write to the EEPROM again and change your installer code by entering 006 (for section 006 obviously) and typing your new installer code. Exit programming by hitting # a few times. You can confirm this worked by powering down the panel, when powering it back up, try your NEW installer code to get into programming.

Note the panel will still have installer lockout enabled at this point, you CAN disable it. To do this, enter Installer Programming again (*8 and enter your NEW installer code that you picked above). Enter section 991. It will prompt for your installer code again, enter it, then press 991 again. Installer lockout should now be disabled!

Here’s a full uncut video showing that this does indeed work.

Update January 30/2016

I can’t believe how popular this post has been, so thanks to everyone who has visited, and hopefully this has helped you in some way! As a small update, I would like to confirm that this exact same method also works on PC1555 boards as well!

61 thoughts on “Bypass Installer Lockout on PC5010 (DSC)”

    1. Hey Mark,
      While I’m sure it’s possible but after looking at a PC1616 I had laying around real quick, the ICs are much smaller and surface mounted on the revision I have (obviously much newer than the PC5010). I’ll see if I can find a pin out or some info on the data pins at least, but I find it a lot harder to connect to surface mount pins as you can easily snap them off with a clip sometimes. Will report back if I can find any info for you.
      P.S.
      Did you try downloading to it via DLS through PC Link or by connected an alternate communicator up to it? This might be much easier if downloading isn’t locked out/default download access code

          1. Bradley A …your post is very good, but still having trouble. Pls contact me regarding DSC 832 5010 trouble.

  1. Hi Bradley,

    For some reason I can’t get the Bypass Installer Lockout solution to work on my DSC5010. I have disconnected two separate modules to the board thinking that might be the problem, but every time I power it back up with the jumper in place, I still get the same 8-10 beeps and am unable to reset the Installer Code.

    Any way you can help?

    Thanks,
    Joe

    1. Hey Joe,
      I would be glad to help you with this!
      Can you post a picture of your connected jumper as well as the main DSC Chip on the board?
      I’m wondering if something changed between revisions and maybe this solution does not work are other revisions.

    2. I armed my DSC5010 and now I cannot rem the code, so I did connected the unit. Right now it’s remaining on armed :(
      I followed your instructions,

      1. I followed your instructions, I do not get the beeps
      2. I was able to get the programming to come up
      3. After entering the 006 and new code, the systems goes back into armed. (yes I disconnected the short)
      So I am not getting past this section….
      The green ready lights comes on etc, but goes right back into armed.
      Should NOT reset everything, why is it still armed?

      Help

      1. Hi Lennox, once the system is armed you need a code to disarm it, otherwise any burglar could just cut power to the system and power it back up in an unarmed state (which would be a huge security flaw). Section 006 is for the installer code only, which will not arm or disarm the system. Now, I have not tested this on an armed panel, but instead, you should use section 007, which is for Master Code programming. Follow the same procedure as above, just use section 007 instead and program your new code in. Then try disarming the system with the code you just entered, and report back if that works.
        Thanks for reading!

    1. Hi Keith,
      Unfortuntely I do not have experience with unlocking that particular board, nor do I have one kicking around in order to test it. Could you post the IC model number on the board and I will see if I can find anything for you?

  2. Hello to everyone, I’m looking for possibilities to reset my DSC 5010 rev04 (40pin Chip R2004 06000464 9638 KW) without loosing all of the settings.. so this installer code reset seems like the golden ticket :) I don’t have an installer lock-out, so hard reset is always an option but I would prefer to not program the panel from zero :)
    in youtube there is one video where they state that to reset this 40 pin chip you need to ground pin 37. But it’s not working for me.. after I short the pin 37 and enter *8 5010 I get a long 2s beep as if I would enter a wrong code and completely other zones are shown as active.. One thing that I spotted is that my board does not have a PC-Link pin out.. Does any one have any ideas are there any option that I could try to reset the installer code on this specific board?

    1. Hi Vaidas,
      It looks like you have the correct info. On the 40 pin chip pin# 37 is the same as pin# 25 on the 28 pin chip. So you should power down the panel (both AC and Battery need to be disconnected). Short pin# 37 to COM. Power up panel and *8 5010 should get you in there. Once in, disconnect the short and reprogram your installer code. Let us know if it works!

  3. Sadly no. As I wrote I tried this method but in my system when pin 37 is shorted to COM I enter *8 5010 I get a long 2s beep – as code invalid. I assume that’s because my board does not have a PC-Link pin out, pin 37 is not active (pin 25 on 28 pin chip and 37 on the 40 pin chip are data transmission pins as I read on other forums). So it seams my only option is to factory reset it..
    Good thing is that my system is not installer locked, so I dived shortly in to the DSC programming and it seams it’s not that difficult to do..

    1. Thats too bad it did not work. However you are correct that DSC programming is very straight forward! If you get stuck at all, feel free to post back!! Thanks for reading

  4. Did you ever get it to work with the pc1616? The installer code is locked and I get the 10 clicks on power up. I have some dls software but is is not for the 1616 it is DLS-1 upgrade 3.5 disk V6.72c(talk about old)

    1. Thanks for reading David. I’m going to tackle both your comments in a single reply here. First off, DLS3 (or DLS2002) should both work with a PC1616, though I prefer DLS5 myself if you can get a copy. You can absolutely reset the installer code with the DLS software and your PC Link kit IF you have the DLS access code. The default access code for that board is 161600. However, some alarm companies also change that when they set it up as well (just like the installer code). If you do not have the DLS access code, then you will not be able to connect with the DLS software.

      To answer your other question, a close friend of mine has successfully been able to break into a locked out PC1616 using methods that are beyond the scope of my knowledge. I’m hoping to convince him to do a guest post soon on the process, though be warned it’s not nearly as simple as shorting out a pin on an IC anymore.

      Be sure to subscribe on the left if you want a notification when that post comes out!

    1. An IC clip is just a little clip that allows you to connect directly to a lead on the IC. It just helps to make sure you don’t accidentally touch other pins, as well as clips on so you don’t have to hold the wire the whole time. A piece of wire absolutely will work fine, just be careful not to touch any of the other pins or short anything out!

  5. thank you so much, after a couple attempts I got the installer code changed, used a small single strand wire to get it done as opposed to waiting on an IC clip delivery from Amazon.

    This operation apparently doesn’t change the master code, so I figured that out, then set the system date and time and now my alarm system is operating again after 10 years of no use. Appreciate it!

  6. Thank you for this wonderful post, Have you any experience about the PC5016 Rev2 it has differents ICs

    – Zilog uC Z86C91(16PSC)
    – M27C512-12F1 UVPROM
    – DSC chip 06000296 (C20935)
    – DSC chip 06000309 (C21445)

    Or could you describe us how did you found this method.

    thank you.

    Alex

  7. Can you confirm this will work with a DSC PC5020? I know the master code but not the installer code. I have a door that has a contact that was never connected and I need to add it to a zone and add a wireless device for a door that I cannot trace the hardwire back to the panel. Foster Care license is pending we get this fixed. Also, when this resets the installer code all of the other settings like connection to monitoring company are still the same, right?

    1. I cannot confirm whether this will work on a PC5020 as I do not have one to test. If the chip is the same, I don’t see any reason that it would not work. However test at your own risk. You are correct as for the other information, this does NOT default the panel when followed correctly. It simply makes the panel THINK its in a default state, allowing you to gain access to installer programming with the default code and change the installer code.

    1. I’m sorry, but at this time I cannot confirm whether this works on a PC5020 as I do not have one to test. If the chip is the same, it should work, however proceed at your own risk. Sorry I couldn’t be of more help at this time.

      1. good news i just realized it is a pc5010, thank you for this helpful post. i am hoping my new alarm person can do this to avoid having to get a new panel. To be clear does this mean he would not have to redo all the zones if this works or will he still need to reprogram once he successfully unlocks the panel. Secondly is it possible that their is an installer code but the panel was not locked down or is it the same thing.

        1. No problem, glad I could help! If he follows the instructions correctly, it will reset the installer code only and not touch any other zones or programming of the system! Post back with your results!

  8. Hi Bradley, thank you for the post. Right now, my situation is my PC 5010 is ARMED and LOCKED. The first challenge for me now is to get it out of ARMED status. We are second owner of the house, the previous owner didn’t leave any code to disarm the system. I read somewhere that short Zone 1 and PGM 1 will do a factory reset except the installer code. Do you know if I perform the factory reset now, will my system get out of ARMED status? Thank you very much.

  9. Hey Bradley, I find the answer to my question after I carefully read your article. I guess the only way left to me is either lucky guess the Master code or buy a new panel.

  10. I purchased a pre-owned home in 2008 and quickly bricked the existing Power632/PC1555MX system.

    I tried to factory reset the panel (shorting Zone 1 and PGM1 together) before learning about installer lockout … which was enabled. To make things worse, I started futzing around with the keypad and managed to quick-arm (*0) the system! I didn’t know the prior owner’s master code to disarm it, so once the exit delay expired, the system was armed! From what I understood at the time, without first disarming it, there was absolutely no way to reprogram it.

    This morning, I decided to poke around some more and found your blog entry. I’m certain I tried this method many years ago without success. In fact, it appeared unsuccessful many times today but I refused to give up. I followed your process to change the installer code, but since the system was armed, and remained armed after each power cycle, and I still didn’t know the master code, I still couldn’t disarm it. I remained unable to change the master code without first knowing it.

    Before giving up, I tried to disable installer lockout with the steps you provided. Surprisingly, when I reconnected power, the relay no longer clicked, indicating installer lockout had been disabled! I was then able to factory reset the panel with the short between Zone 1 and PGM1. From there, I’ve been able to reprogram my zones, entry/exit chimes, and can finally arm/disarm my system!

    My kids just walked in and asked, “when did we get a new security system?”

    THANK YOU!!!

      1. I just unlocked a neighbor’s that was in the same state: both installer locked AND armed. Unfortunately, it was a day after a new company installed their new system, insisting nothing could be done with their old system, but at least they now have a complete working system they can sell online. Upside for me, they gave me their old LCD panel!

        It took me a minute to recall the exact steps, but here’s a summary in case it helps others.

        The first steps are those you posted:

        – with panel powered off, short COM to pin 25;

        I used a paper clip secured into one of the unused COMs, bent with not-so-precise tension that held it onto pin 25, with tape for use as a handle to disconnect when pulled. This risks accidentally shorting the nearby pins, but I did many dry-runs to assure myself it probably wouldn’t. The IC clip is the safest route.

        – power up panel; no more phone relay clicks!

        – *8 5010, remove short from pin 25, 006 1234 991 1234 991 #

        – power cycle panel (leave off for at least 10 seconds for the capacitors to drain); still armed, but no longer installer locked!

        Now to factory reset it (factory reset codes won’t work because the system is armed):

        – power down panel, short PGM1 to Z1;

        – power up panel; wait 30 seconds;

        – power off panel; remove PGM1-Z1 short;

        – power on and discover you have a factory reset panel!

        – program panel as needed (this was significantly easier than I imagined once I sat down and actually started doing it);

        … someone let John from Toronto know! :-)

  11. Hi there, any ideas if this works on a pc-3000 R7? (Mine is installer locked). I tried with a wire as described on on AC power the alarm gets triggered? Any ideas or thoughts?

  12. Hi there, Thank you greatly for the video and detailed instructions. I was able to reprogram the installer code and disable the phone dialer etc..

    Thanks a Million!!!

  13. Hi Bradley,
    my English is wrong, I’am sorry.
    I have a DSC PC585 Rev 04 panel. Panel is Armed and locked.
    Your procedure works 100%
    Many, many Thanks!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

    Microcontroller is 06001400 V2.31

  14. Hi Bradley, I successfully used your guide to reset the Installer Code on a PC1565. Don’t know if it was installer locked but sure did work for the Installer Code. Thanks.

  15. It just worked on my PC1555MX. Awesome!!! … I had been trying to resolve this for weeks. Everything had been working for us, but after converting to VoIP (Ooma), I had resolved everything except that the telephone line monitoring (TLM) would fire off the alarm at night sometimes during maintenance windows at our internet provider. After your fix, I was able to alter the setting to keep TLM active but not set off the alarm at night if a maintenance window occurred. Thanks a bunch!!!

    1. Hi Lawrence,
      We are working on getting a post up on how to bypass installer lockout on the newer Powerseries. We do have a method, but its not as simple as this and requires some external equipment. Please subscribe to be notified when we get this post out! THanks for reading!

      1. Hey, I’ve just subscribed to stay tuned about this. I need to bypass de lockout of a 1832 as well. Looking forward to it, thanks!

  16. Thank you very much for documenting your findings! Worked like a charm on a PC1555MX aka Power 632 — note that the default Installer Code for this board is 5555.

  17. How do you recover forgotten installer password on PC5010 Version 6.4.
    I have lost the password and I need it to setup the panel.

  18. Hi Bradley , So I own my system and just decided I don’t want to sign a new monitoring contract would rather monitor myself, they will not give me the installer code or the master code , i guess as punishment for not renewing my contract. If I were to follow your directions to reset the code master or installer would i then have to reprogram everything as far as door sensors and motion detectors?

    1. Hey Jay,
      First of all, if you own the equipment, from a legal standpoint (I suppose depending where you live) the monitoring company either has to give you the installer code OR change the installer code to something you request so that you can manage your own system. Not giving you that access when you own the equipment is the same as a dealer selling you a car but not giving you the keys. /end rant
      If your panel is a 5010 or a 1555 and you follow my instructions, none of the other programming will be reset, ONLY the installer code. That’s the beauty of this method as it allows one to gain installer access to the system without actually loosing any other programming! I just did this with another board on Friday for that very reason. Let me know if you run into any snags!

      1. Im in British Columbia Canada, and ya they got a little pissy when i said im fed up of the false alarm calls and having to deal with the police when its a false alarm and that i have IP cameras so if there is an alarm call me first before calling police and ill check the cameras before you send the cavalry to another false alarm, they said something about there computerised system and they only call the location back and if there is no response they call police. So i said well cancel my monitoring, 14 years they had a good run from us, I then i tried to program my number into it to self monitor, found all the installer and master codes had been changed, so i called them and they said we weren’t the original installer of your equipment so we don’t know the code, try and find the original installer.

        1. wait apparently the master code is my code for arm and disarm for shits and giggles i just checked it and it works so that means i only need to reprogram installer code, right

          1. Hey Jay,
            The master code will let you reprogram new user codes, but you cannot change the installer code with the master code. To change the installer code you need to get into installer programming ( * + 8 + [installer code] ). The default on your panel should either be 5010 or 5555. As for the company saying they weren’t the original installer is irrelevant, ask them how they were able to program the phone number for their monitoring station without the installer code. They needed it at one point to program the system, they just don’t want to give it to you. Everything aside, if it is a 5010, I would just follow my instructions and break into it yourself! Let us know how you make out!

  19. Looking for some help. Recently defaulted my DSC 832 back to factory settings b/c didn’t have the installer code. Was able to remove all trouble codes and set system date and time. Was able to set a new master code and installer code. Tried setting all 8 zones and seems like it worked but when I exit programming mode all zones on my led display are lit up and don’t have ready light. I used *8 installer code 001 01 06 03 03 03 03 03 03 ## I didn’t setup an partitions. Any suggestion?

  20. Hey Bradley!
    Just bumped into your post and hope you can help me.
    I’ve bought a condo with PC1500 (written on a panel) or PC1550 ver 4.0(written on a chip) system. I don’t know the code, neither Master nor Install codes are working.
    Any idea how can I reset it?
    IC code is 160 3469 A, I beleive.
    Thank you!

    1. Hey Marc,
      This will not work on any of the newer PowerSeries (1616, 1832, 1864, etc.). They have completely different chips. We have discovered a way to unlock these boards but the method is iffy at best until we do further testing. Once we have the solution bulletproof there will be a post about it but theres no time frame right now unfortunately

Leave a Reply