HRESULT 0x80280803 (TPM_E_DEFEND_LOCK

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

The TPM is defending against dictionary attacks and is in a time-out period.

Previous	Next
TPM_E_DOING_SELFTEST	TPM_20_E_CONTEXT_GAP

TPM_E_DEFEND_LOCK_RUNNING

Technical interpretation

TPM_E_DEFEND_LOCK_RUNNING (0x80280803) belongs to Windows command mediation around the TPM. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the TPM anti-hammering or dictionary-attack defense timer is active, so protected authorization attempts are being rejected.

The first producer to identify for TPM_E_DEFEND_LOCK_RUNNING is TBS command blocking, virtual-handle translation, retry or anti-hammering logic. For TPM_E_DEFEND_LOCK_RUNNING, windows TBS schedules and mediates commands from multiple clients. For TPM_E_DEFEND_LOCK_RUNNING, it can block commands, translate virtual handles, request retry, and preserve anti-hammering policy before or after the raw device command path.

Inputs and state to capture

Preserve these TPM_E_DEFEND_LOCK_RUNNING items before changing anything:

TPM_E_DEFEND_LOCK_RUNNING and 0x80280803, the exact returning method or command, and the first nested status.
failed authorization count, lockout timing if available, affected entity, command and auth session, system time behavior, and prior failed attempts.
The TPM generation, manufacturer/firmware revision, Windows build, caller identity and TBS/provider state for TPM_E_DEFEND_LOCK_RUNNING.
The complete opaque TPM_E_DEFEND_LOCK_RUNNING request artifacts, redacting authorization secrets but not rewriting structure boundaries.

Validate without broad changes

Run this focused check: stop attempts and observe recovery after the policy-defined interval rather than testing more passwords. Do not combine the TPM_E_DEFEND_LOCK_RUNNING test with firmware updates, TPM clearing, account changes, key recreation and policy edits in the same trial; such a result cannot isolate this boundary.

Checkpoint	Pass condition
the TPM anti-hammering or dictionary-attack defense timer is active, so protected authorization attempts are being rejected	The original `TPM_E_DEFEND_LOCK_RUNNING` command reaches the next defined state without returning this result.
Security behavior	The `TPM_E_DEFEND_LOCK_RUNNING` verification still uses the intended TPM, authorization, locality and policy.
Output integrity	The object, digest, event log or state transition produced after `TPM_E_DEFEND_LOCK_RUNNING` validates independently.

Neighboring response codes

Related result	Separate meaning
`TPM_E_RETRY`	The TPM is too busy to respond to the command immediately, but the command could be resubmitted at a later time — a separate checkpoint when compared with `TPM_E_DEFEND_LOCK_RUNNING`.
`TPM_E_EMBEDDED_COMMAND_UNSUPPORTED`	The command within the transport is not supported — a separate checkpoint when compared with `TPM_E_DEFEND_LOCK_RUNNING`.
`TPM_E_EMBEDDED_COMMAND_BLOCKED`	The command within the transport was blocked — a separate checkpoint when compared with `TPM_E_DEFEND_LOCK_RUNNING`.

The practical distinction is that TPM_E_RETRY reports temporary command load; this code is a security lockout caused by authorization failures.

Fix and verify

The supported direction is to correct the authorization source, respect lockout policy, and use supported recovery or administrative mechanisms. For TPM_E_DEFEND_LOCK_RUNNING, do not disable command policy globally to make one test pass. For TPM_E_DEFEND_LOCK_RUNNING, first establish the caller, command code and supported higher-level alternative, because command blocking is a security boundary.

If the same bytes still return TPM_E_DEFEND_LOCK_RUNNING after the documented preconditions are satisfied, retain this code-specific trace for the platform vendor or Windows component owner rather than erasing state.

Technical references

Microsoft: Command Blocking in TBS — source for the TPM_E_DEFEND_LOCK_RUNNING checkpoint.
Microsoft: Using TPM Base Services — source for the TPM_E_DEFEND_LOCK_RUNNING checkpoint.
Microsoft: Tbsip_Submit_Command — source for the TPM_E_DEFEND_LOCK_RUNNING checkpoint.
TCG: TPM 1.2 Main Specification — source for the TPM_E_DEFEND_LOCK_RUNNING checkpoint.

Looking for a different code? Search another status or error code.