Solved

TPM locked out only early in the morning

Posted on 2013-06-13
9
8,322 Views
Last Modified: 2013-07-03
I have an HP Folio 9470m ultrabook that is causing some grief with BitLocker for one of our users who routinely comes into the office at 6:00 AM.  He attempts to log in using his BitLocker PIN and is notified that his password has been attempted too many times.  If I try to recreate this issue when I get into the office at 8:00 AM, I am unable to do so and everything works fine.  So this morning I decided to come in bright and early with him just to see this first hand.  What I've confirmed is that it does in fact seem as though the TPM is in a lockout mode.  BitLocker will not accept the PIN and states that a password has been attempted too many times.  I am able to bypass the PIN using a recovery key and boot to Windows, but when I attempt to launch the BitLocker management console, I receive an error that "the TPM is defending against dictionary attacks and is in a time-out period".

After doing a bit of reading up on this, I've found that this error message indicates that the TPM is in lockout, and that the only way to unlock is via the TPM Administration console, or by logging onto Windows using a recovery key and leaving the computer powered on for 20 hours.

So my question is this:  Why is this only happening at 6:00 AM everyday and then appears to be fine when we check things out at 8:00 AM?

Does anyone have any thoughts on this?
0
Comment
Question by:siskinds
  • 4
  • 4
9 Comments
 
LVL 78

Expert Comment

by:David Johnson, CD, MVP
ID: 39246396
Any security cam logs? Does the user have any domain logon time restrictions?
0
 
LVL 62

Expert Comment

by:btan
ID: 39247573
First in this current state, even if you tried to go in to the BIOS and clear the TPM, that will not resolve the issue. Waiting for the time-out period to expire is the only solutionas it is defined by manufacturer. The TPM will lock out for the entire time-out period and additional attempts at resetting the lock will fail. The 6am would potentially falls within that time-out period.  This MS article bring about the "anti-hammering" lockout period which I see relevance (see Method 1 and 3)

http://support.microsoft.com/kb/926187

===========
Method 1 - "...If you repeatedly retry a personal identification number (PIN) in a short period of time, you may increase the TPM lockout period. Also, as long as the TPM is locked out, you may be unable to gain access to the computer even if you enter the correct PIN. "

Method 3 - "...Some TPM devices may not reset the lockout period after a successful logon. Instead, these devices may store unsuccessful lockout attempts. In this situation, you may receive the lockout error message if you enter one incorrect PIN. Also, the lockout period may last for increasingly longer times..."
===========

As for resolution, to Reset TPM Lockout would get us back to original state. See link below or even in a/m Method 1-3 . But if you do not have the TPM owner password, there is back to original state. Note that The TPM owner password is configured when you first enable BitLocker on the computer. This password differs from the TPM PIN.

http://trekker.net/archives/how-do-i-fix-the-tpm-is-defending-against-dictionary-attacks-and-is-in-a-time-out-period/
0
 
LVL 62

Expert Comment

by:btan
ID: 39247578
Another to see if useful....
http://winintro.ru/tpmadmin.en/html/21a02891-8efe-462a-81ea-85482b3da000.htm

What should I do if I do not remember my TPM owner password?

It is possible that the TPM owner authorization hash value was saved to a file ending with a .tpm extension when the administrator originally took ownership of the TPM on your computer. Search your file system for a file ending with .tpm. If you printed your BitLocker recovery password, your TPM owner password may have been printed at the same time. If you cannot find your TPM owner password, you can clear the TPM and take ownership again. This should be done carefully because data encrypted with the TPM will be lost. If you are using BitLocker, make sure to suspend or turn off BitLocker before clearing the TPM....
0
 

Author Comment

by:siskinds
ID: 39247630
Thanks for the comments and suggestions guys - let me give you a little more background information.  

1. I've confirmed that the TPM lockout is clearing at a later time in the day.  The strange thing is that it is continually going into lockout mode at some point overnight.

2. I do have a valid .TPM owner password file which I am able to validate when the TPM is not in a locked state, but strangely, I am not able to use this file to reset a lockout at times when the TPM is actually locked.  I receive an error message which suggests leaving the laptop for an unspecified amount of time until the lock clears on its own.

3. We do not have any account lockout policies defined on the domain (not that they would be related to a TPM lockout anyways) and this user did not experience any login issues prior to receiving this new hardware.
0
Do email signature updates give you a headache?

Constantly trying to correctly format email signatures? Spending all of your time at every user’s desk to make updates? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today!

 
LVL 62

Expert Comment

by:btan
ID: 39247747
I hope this is not hardware issues as it is not norm.  But it is dependent on tpm manufacturer policy..we are none the wiser. So if MS article stands, it is independent whether account lockout is configured. Nonetheless, not being able to reset or seeing recurrence of this after reset do render higher probability hw esp if other domain machine does not have this issue. I hope it is not time sync which is unlikely contributing any false positive but we are not sure of the tpm internal time clock though
0
 

Author Comment

by:siskinds
ID: 39247771
I am inclined to think that this may be hardware-related as well.  Perhaps disabling BitLocker and clearing the TPM ownership back to default could resolve this... likely worth a shot if these problems persist.
0
 
LVL 62

Expert Comment

by:btan
ID: 39247933
Agree do share with us
0
 

Accepted Solution

by:
siskinds earned 0 total points
ID: 39285403
Ultimately, the solution to this issue was to log on using the recovery key and leave the machine up and running until the lock cleared and then left it on for an additional 24 hours.  It doesn't make much sense to me, but since doing this, we have not had any issues with TPM lockouts on this machine.  Thanks for all of your input on this everyone.
0
 

Author Closing Comment

by:siskinds
ID: 39296013
Problem eventually cleared itself.
0

Featured Post

Promote certifications in your email signature

Has your company recently won an award or achieved a certification? They'll no doubt want to show it off. Email signature images used to promote certifications & awards can instantly establish credibility with a recipient and provide you with numerous benefits.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many companies are looking to get out of the datacenter business and to services like Microsoft Azure to provide Infrastructure as a Service (IaaS) solutions for legacy client server workloads, rather than continuing to make capital investments in h…
How to record audio from input sources to your PC – connected devices, connected preamp to record vinyl discs, streaming media, that play through your audio card: Vista, Windows 7, Windows 8, Windows 8.1 and Windows 10 – both 32 bit & 64.
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now