| Previous | Next |
| TPM_20_E_NV_RATE | TPM_20_E_RETRY |
TPM_20_E_LOCKOUT
Dictionary-attack protection has blocked authorization
TPM_20_E_LOCKOUT is the Windows form of TPM_RC_LOCKOUT. Too many failed authorization attempts can place the TPM in dictionary-attack (DA) lockout. While active, authorization for DA-protected objects is refused even when a later credential is correct.
The lockout state is governed by TPM parameters such as maximum tries, recovery time, and lockout recovery. Clearing it may require lockout-hierarchy authorization or waiting for recovery. Guessing credentials more rapidly is counterproductive because it can extend or retrigger protection.
What to do
- Stop automated retries and identify which object or hierarchy is receiving bad authorization.
- Inspect the configured DA parameters and remaining recovery interval through approved management tools.
- Use the lockout authorization only through a controlled administrative procedure.
- Do not clear the whole TPM merely to reset lockout unless loss of all TPM-protected material is acceptable and documented.
References
Looking for a different code? Search another status or error code.