TPM Failure Tries, Recovery Time and Lockout Recovery

Failure Tries:

1. Up to 13 per day, see the following table for detailed failure-lockout periods.
2. While TPM is in lockout, no authorization command is accepted during the lockout period.

Failure Tries Recovery Time:

1. The failure try counts will be reset after 24 hours from the last failure try.
2. The timer will be reset after the TPM VSB (TPM chip power cell) is powered-up.

Lockout Recovery:

• Keep the TPM VSB powered during the lockout period and wait for the lockout duration period to expire.

• Reset both the failure tries and the lockout state by using the Microsoft TPM Management Console with the correct owner password.

Failure Tries:

1. TPM Default maximum tries count is set to 10.
2. Operating system (Windows) changes the setting to 32 after the TPM is provisioning (taken ownership) by the Operating System.
3. The TPM lockout is set for 24 hours while the failure tries exceed the maximum value.

Failure Trials Recovery Time:

1. Decrement per 2 hours.
2. The timer will be reset after the TPM VSB (TPM chip power cell) is powered-up.

Lockout Recovery:

• Keep the TPM VSB powered up during the lockout period and wait until the lockout duration has expired.

• Reset both the failure tries and lockout state using the Microsoft TPM Management Console with the correct owner password.

Operating System Group Policy for TPM:

1. Microsoft allows you to use group policy to manage / limit lockout behavior to prevent how the TPM enters hardware lockout state.
2. There are three policies that can effect to TPM lockout:
   • Standard User Lockout Duration
   • Standard User Individual Lockout Threshold
   • Standard User Total Lockout Threshold

NOTE: See the following Microsoft link to get more group policy setting information: TPM Group Policy settings