Siirry pääsisältöön
Kirjaudu ulos

Tervetuloa Dellin asiakkaaksi

Oma tili
  • Tee tilauksia nopeasti ja helposti
  • Tarkastele tilauksia ja seuraa lähetyksen tilaa
  • Luo tuoteluettelo ja käytä sitä
Kirjaudu sisään Luo tili Premier-kirjautuminen Kumppaniohjelman sisäänkirjautumissivu
Ota yhteyttä

TPM Failure Tries, Recovery Time and Lockout Recovery

Yhteenveto: The article below discusses the TPM chip and in particular the lockout scenarios and recovery information. Some details on TPM group policy and TPM dictionary attacks is also listed.

Tämä artikkeli koskee tuotetta Tämä artikkeli ei koske tuotetta Tämä artikkeli ei liity tiettyyn tuotteeseen. Tässä artikkelissa ei yksilöidä kaikkia tuoteversioita.
Tutustu muihin resursseihin

Oireet

TPM Lockout Content

 

As a security feature the TPM locks itself to help prevent attacks or any kind of unauthorized access. Below provides some information about TPM failure attempt options, lockout recovery times and lockout recovery. TPM specifications are regulated and defined by the Trusted Computing Group (TCG) (English only) This hyperlink is taking you to a website outside of Dell Technologies.

TPM Version Support operating system
TPM1.2 Win 7, Linux and most of Win 8.1
TPM2.0 Windows 10
Table 1: Standard matrix for TPM1.2 vs. TPM2.0 availability on shipping systems

 
NOTE: Some additional resources regarding TPM setup can be found on the Microsoft Technet website:  
 
|

Failure Tries:

  1. Up to 13 per day, see the following table for detailed failure-lockout periods.
  2. While TPM is in lockout, no authorization command is accepted during the lockout period.
 

Failure Tries Recovery Time:

  1. The failure try counts will be reset after 24 hours from the last failure try.
  2. The timer will be reset after the TPM VSB (TPM chip power cell) is powered-up.
 

Lockout Recovery:

  • Keep the TPM VSB powered during the lockout period and wait for the lockout duration period to expire.
Or
  • Reset both the failure tries and the lockout state by using the Microsoft TPM Management Console with the correct owner password.
Example: Setting K to 7 and failLimit to 13, also allows up to 13 authorization failures per day (<5000 per year) and locks up for the following periods:

Table 1: Lockout Durations; K=7, failLimit=13
Number of Failures Lockout Period (Hrs:MM:SS) Accumulative Lockout Period (Hrs:MM:SS)
1 0:00:00 0:00:00
2 0:00:00 0:00:00
3 0:00:00 0:00:00
4 0:00:00 0:00:00
5 0:00:00 0:00:00
6 0:00:00 0:00:00
7 0:00:00 0:00:00
8 0:00:01 0:00:01
9 0:00:04 0:00:05
10 0:00:16 0:00:22
11 0:01:06 0:01:27
12 0:04:22 0:05:50
13 23:54:10 24:00:00
 
NOTE: For further information about the Microsoft TPM Management console see:

Failure Tries:

 
  1. TPM Default maximum tries count is set to 10.
  2. Operating system (Windows) changes the setting to 32 after the TPM is provisioning (taken ownership) by the Operating System.
  3. The TPM lockout is set for 24 hours while the failure tries exceed the maximum value.
 

Failure Trials Recovery Time:

  1. Decrement per 2 hours.
  2. The timer will be reset after the TPM VSB (TPM chip power cell) is powered-up.
 

Lockout Recovery:

  • Keep the TPM VSB powered up during the lockout period and wait until the lockout duration has expired.
Or
  • Reset both the failure tries and lockout state using the Microsoft TPM Management Console with the correct owner password.

Example: Setting K to 7 and failLimit to 13, also allows up to 13 authorization failures per day (<5000 per year) and locks up for the following periods:

Table 1: Lockout Durations; K=7, failLimit=13
Number of Failures Lockout Period (Hrs:MM:SS) Accumulative Lockout Period (Hrs:MM:SS)
1 0:00:00 0:00:00
2 0:00:00 0:00:00
3 0:00:00 0:00:00
4 0:00:00 0:00:00
5 0:00:00 0:00:00
6 0:00:00 0:00:00
7 0:00:00 0:00:00
8 0:00:01 0:00:01
9 0:00:04 0:00:05
10 0:00:16 0:00:22
11 0:01:06 0:01:27
12 0:04:22 0:05:50
13 23:54:10 24:00:00
 
NOTE: For further information about the Microsoft TPM Management Console see:
 

Operating System Group Policy for TPM:

  1. Microsoft allows you to use group policy to manage / limit lockout behavior to prevent how the TPM enters hardware lockout state.
  2. There are three policies that can effect to TPM lockout:
    • Standard User Lockout Duration
    • Standard User Individual Lockout Threshold
    • Standard User Total Lockout Threshold
NOTE: See the following Microsoft link to get more group policy setting information: TPM Group Policy settings  This hyperlink is taking you to a website outside of Dell Technologies

 

TPM is defending against dictionary attacks

 

If a system user has entered their password PIN too many times, you may be presented with this error. "The TPM is defending against dictionary attacks and is in a time-out period."

Going into the BIOS to clear the TPM will not resolve this. You must wait until the lockout period has passed and then follow the recommended lockout recovery options detailed above.

Syy

Not Applicable

Tarkkuus

Not Applicable

Tuotteet, joihin vaikutus kohdistuu

Security, Software
Artikkelin ominaisuudet
Artikkelin numero: 000142311
Artikkelin tyyppi: Solution
Viimeksi muutettu: 16 helmik. 2024
Versio:  6
Etsi vastauksia kysymyksiisi muilta Dell-käyttäjiltä
Tukipalvelut
Tarkista, kuuluuko laitteesi tukipalveluiden piiriin.