Windows 10: TPM/Surface PIN Lockout timer

Anyone know if there's any settings, such as group policy, that can change the lockout behaviour of Windows Hello PINs?

So far i've noticed very inconsistent behaviour. On a VM typing the wrong PIN too many times, even repeatedly, just results in short (30 seconds) lockouts or a requirement to restart the computer.

On my Surface too many wrong tries immediately locks the comuter for 2 hours.

The only difference i can think of is that the Surface has a TMP and the VM does not.

I haven't been able to find anything online that directly talks about this specific issue.

The closest promising lead I found is this group policy: https://docs.microsoft.com/en-us/wi...ity-policy-settings/account-lockout-threshold

however, by default it's already set to no restriction so this leads me to believe that this is a group policy that controls traditional password logins, not the windows hello pins. there are group policies about the PIN strength, but i haven't found any that control the lockout behaviour.

does anyone know if there is such a configuration option to customize the Windows Hello PIN lockout behaviour??

submitted by /u/1brick1wood
[link] [comments]

:)

 

TPM 1.2 Lockout

Hi RobBoston83-

I'm Kevin B. Independent advisor and a Windows 10 user like you. I do apologize that you are experiencing this kind of inconvenience.

For some reason, there's nothing much that w can do since it is not software related problem.

As a security feature the TPM will lock itself to help prevent attacks or any kind of unauthorized access. Below will provide some information on TPM failure attempt options, lockout recovery times and lockout recovery.

Failure Tries:

Up to 13 per day. Please see the following table for detailed failure-lockout periods.

While TPM is in lockout, no authorization command will be accepted during lockout period.

Failure Tries Recovery Time:

The failure try counts will be reset after 24 hours from last failure try.

The timer will be reset after the TPM VSB (TPM chip power cell) is powered-up.

Lockout Recovery:

Keep the TPM VSB powered during the lockout period and wait for the lockout duration period to expire.

Or

Reset both the failure tries and the lockout state by using the Microsoft TPM Management Console with correct owner password.

Hope this will help and have a blessed day!

Thanks.

Kevin B.

Independent advisor

 

TPM 1.2 Lockout

I entered a bitlocker key incorrectly and was told that there were too many attempts. This was about 36 hours ago

I used the recovery key to get onto my laptop but every time I restarted my machine the same error came up.

I have now done the following about 24-hours ago:

• Disabled Bitlocker including decrypting the drive
• Disabled the TPM
• Re-enabled the TPM
• Cleared the TPM

When I try and enable bitlocker again I get the message "The TPM is defending against dictionary attacks and is in a time-out period"

Questions

1) How do I overcome this block?

2) How does the time-out period work - do you have to keep the computer turned on for the whole period for it to reset?

3) Does every time I try and re-enable bitlocker reset the lockout period timer?

It is a Dell laptop so I think the lockout period is 24-hours.

 

TPM lockout for 2 hours

Why do I get TPM locked out of Windows 10 for two hours with error "This sign in option is disabled because of failed sign in attempts or repeated shutdowns. Use a different sign in option or keep your device powered on for at least two hours and then try again." after entering wrong PIN too many times? There is no option to sign in with Microsoft account password on Windows 10 v2004 since it requires Windows Hello sign-in for Microsoft accounts. I had to wait two hours for the lockout to expire and if I get one more incorrect pin attempt I get locked out again for another two hours. Is there a way to reset the TPM 2.0 lockout on Windows 10 v2004. The TPM lockout makes the computer unusable for the next two hours. I have an ASUS motherboard and an ASUS TPM-M R2.0 module plugged into the motherboard TPM connector.