Symptoms
TPM Lockout Content
As a security feature the TPM locks itself to help prevent attacks or any kind of unauthorized access. Below provides some information about TPM failure attempt options, lockout recovery times and lockout recovery. TPM specifications are regulated and defined by the Trusted Computing Group (TCG) (English only) 
.
| TPM Version | Support operating system |
|---|---|
| TPM1.2 | Win 7, Linux and most of Win 8.1 |
| TPM2.0 | Windows 10 |
Table 1: Standard matrix for TPM1.2 vs. TPM2.0 availability on shipping systems
NOTE: Some additional resources regarding TPM setup can be found on the Microsoft Technet website:
TPM1.2
Failure Tries:
- Up to 13 per day, see the following table for detailed failure-lockout periods.
- While TPM is in lockout, no authorization command is accepted during the lockout period.
Failure Tries Recovery Time:
- The failure try counts will be reset after 24 hours from the last failure try.
- The timer will be reset after the TPM VSB (TPM chip power cell) is powered-up.
Lockout Recovery:
- Keep the TPM VSB powered during the lockout period and wait for the lockout duration period to expire.
Or
- Reset both the failure tries and the lockout state by using the Microsoft TPM Management Console with the correct owner password.
Example: Setting K to 7 and failLimit to 13, also allows up to 13 authorization failures per day (<5000 per year) and locks up for the following periods:
Table 1: Lockout Durations; K=7, failLimit=13
| Number of Failures | Lockout Period (Hrs:MM:SS) | Accumulative Lockout Period (Hrs:MM:SS) |
|---|---|---|
| 1 | 0:00:00 | 0:00:00 |
| 2 | 0:00:00 | 0:00:00 |
| 3 | 0:00:00 | 0:00:00 |
| 4 | 0:00:00 | 0:00:00 |
| 5 | 0:00:00 | 0:00:00 |
| 6 | 0:00:00 | 0:00:00 |
| 7 | 0:00:00 | 0:00:00 |
| 8 | 0:00:01 | 0:00:01 |
| 9 | 0:00:04 | 0:00:05 |
| 10 | 0:00:16 | 0:00:22 |
| 11 | 0:01:06 | 0:01:27 |
| 12 | 0:04:22 | 0:05:50 |
| 13 | 23:54:10 | 24:00:00 |
NOTE: For further information about the Microsoft TPM Management console see:
TPM2.0
Failure Tries:
- TPM Default maximum tries count is set to 10.
- Operating system (Windows) changes the setting to 32 after the TPM is provisioning (taken ownership) by the Operating System.
- The TPM lockout is set for 24 hours while the failure tries exceedthe maximum value.
Failure Trials Recovery Time:
- Decrement per 2 hours.
- The timer will be reset after the TPM VSB (TPM chip power cell) is powered-up.
Lockout Recovery:
- Keep the TPM VSB powered up during the lockout period and wait until the lockout duration has expired.
Or
- Reset both the failure tries and lockout state using the Microsoft TPM Management Console with the correct owner password.
Example: Setting K to 7 and failLimit to 13, also allows up to 13 authorization failures per day (<5000 per year) and locks up for the following periods:
Table 1: Lockout Durations; K=7, failLimit=13
| Number of Failures | Lockout Period (Hrs:MM:SS) | Accumulative Lockout Period (Hrs:MM:SS) |
|---|---|---|
| 1 | 0:00:00 | 0:00:00 |
| 2 | 0:00:00 | 0:00:00 |
| 3 | 0:00:00 | 0:00:00 |
| 4 | 0:00:00 | 0:00:00 |
| 5 | 0:00:00 | 0:00:00 |
| 6 | 0:00:00 | 0:00:00 |
| 7 | 0:00:00 | 0:00:00 |
| 8 | 0:00:01 | 0:00:01 |
| 9 | 0:00:04 | 0:00:05 |
| 10 | 0:00:16 | 0:00:22 |
| 11 | 0:01:06 | 0:01:27 |
| 12 | 0:04:22 | 0:05:50 |
| 13 | 23:54:10 | 24:00:00 |
NOTE: For further information about the Microsoft TPM Management Console see:
Operating System Group Policy for TPM:
- Microsoft allows you to use group policy to manage / limit lockout behavior to prevent how the TPM enters hardware lockout state.
- There are three policies that can effect to TPM lockout:
- Standard User Lockout Duration
- Standard User Individual Lockout Threshold
- Standard User Total Lockout Threshold
NOTE:See thefollowing Microsoft link to get more group policy setting information: TPM Group Policy settings 
TPM is defending against dictionary attacks
If a systemuser has entered their password PIN too many times, you may be presented with this error. "The TPM is defending against dictionary attacks and is in a time-out period."
Going into the BIOS to clear the TPM will not resolve this. You must wait until the lockout period has passed and then follow the recommended lockout recovery options detailed above.
Cause
Not Applicable
Resolution
Not Applicable
Affected Products
Security, Software
