Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Create and access a list of your products
Sign In Create an Account Premier Sign In Partner Program Sign In
Contact Us
Some article numbers may have changed. If this isn't what you're looking for, try searching all articles. Search articles

TPM Failure Tries, Recovery Time and Lockout Recovery

Summary: The article below discusses the TPM chip and in particular the lockout scenarios and recovery information. Some details on TPM group policy and TPM dictionary attacks is also listed.

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

TPM Lockout Content

 

As a security feature the TPM locks itself to help prevent attacks or any kind of unauthorized access. Below provides some information about TPM failure attempt options, lockout recovery times and lockout recovery. TPM specifications are regulated and defined by the Trusted Computing Group (TCG) (English only) This hyperlink is taking you to a website outside of Dell Technologies.

TPM Version Support operating system
TPM1.2 Win 7, Linux and most of Win 8.1
TPM2.0 Windows 10
Table 1: Standard matrix for TPM1.2 vs. TPM2.0 availability on shipping systems

 
NOTE: Some additional resources regarding TPM setup can be found on the Microsoft Technet website:  
 
|

Failure Tries:

  1. Up to 13 per day, see the following table for detailed failure-lockout periods.
  2. While TPM is in lockout, no authorization command is accepted during the lockout period.
 

Failure Tries Recovery Time:

  1. The failure try counts will be reset after 24 hours from the last failure try.
  2. The timer will be reset after the TPM VSB (TPM chip power cell) is powered-up.
 

Lockout Recovery:

  • Keep the TPM VSB powered during the lockout period and wait for the lockout duration period to expire.
Or
  • Reset both the failure tries and the lockout state by using the Microsoft TPM Management Console with the correct owner password.
Example: Setting K to 7 and failLimit to 13, also allows up to 13 authorization failures per day (<5000 per year) and locks up for the following periods:

Table 1: Lockout Durations; K=7, failLimit=13
Number of Failures Lockout Period (Hrs:MM:SS) Accumulative Lockout Period (Hrs:MM:SS)
1 0:00:00 0:00:00
2 0:00:00 0:00:00
3 0:00:00 0:00:00
4 0:00:00 0:00:00
5 0:00:00 0:00:00
6 0:00:00 0:00:00
7 0:00:00 0:00:00
8 0:00:01 0:00:01
9 0:00:04 0:00:05
10 0:00:16 0:00:22
11 0:01:06 0:01:27
12 0:04:22 0:05:50
13 23:54:10 24:00:00
 
NOTE: For further information about the Microsoft TPM Management console see:

Failure Tries:

 
  1. TPM Default maximum tries count is set to 10.
  2. Operating system (Windows) changes the setting to 32 after the TPM is provisioning (taken ownership) by the Operating System.
  3. The TPM lockout is set for 24 hours while the failure tries exceed the maximum value.
 

Failure Trials Recovery Time:

  1. Decrement per 2 hours.
  2. The timer will be reset after the TPM VSB (TPM chip power cell) is powered-up.
 

Lockout Recovery:

  • Keep the TPM VSB powered up during the lockout period and wait until the lockout duration has expired.
Or
  • Reset both the failure tries and lockout state using the Microsoft TPM Management Console with the correct owner password.

Example: Setting K to 7 and failLimit to 13, also allows up to 13 authorization failures per day (<5000 per year) and locks up for the following periods:

Table 1: Lockout Durations; K=7, failLimit=13
Number of Failures Lockout Period (Hrs:MM:SS) Accumulative Lockout Period (Hrs:MM:SS)
1 0:00:00 0:00:00
2 0:00:00 0:00:00
3 0:00:00 0:00:00
4 0:00:00 0:00:00
5 0:00:00 0:00:00
6 0:00:00 0:00:00
7 0:00:00 0:00:00
8 0:00:01 0:00:01
9 0:00:04 0:00:05
10 0:00:16 0:00:22
11 0:01:06 0:01:27
12 0:04:22 0:05:50
13 23:54:10 24:00:00
 
NOTE: For further information about the Microsoft TPM Management Console see:
 

Operating System Group Policy for TPM:

  1. Microsoft allows you to use group policy to manage / limit lockout behavior to prevent how the TPM enters hardware lockout state.
  2. There are three policies that can effect to TPM lockout:
    • Standard User Lockout Duration
    • Standard User Individual Lockout Threshold
    • Standard User Total Lockout Threshold
NOTE: See the following Microsoft link to get more group policy setting information: TPM Group Policy settings  This hyperlink is taking you to a website outside of Dell Technologies

 

TPM is defending against dictionary attacks

 

If a system user has entered their password PIN too many times, you may be presented with this error. "The TPM is defending against dictionary attacks and is in a time-out period."

Going into the BIOS to clear the TPM will not resolve this. You must wait until the lockout period has passed and then follow the recommended lockout recovery options detailed above.

Cause

Not Applicable

Resolution

Not Applicable

Affected Products

Security, Software
Article Properties
Article Number: 000142311
Article Type: Solution
Last Modified: 16 Feb 2024
Version:  6
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.