| Previous | Next |
| STATUS_PCP_KEY_NOT_SIGNING_KEY | STATUS_PCP_CLAIM_TYPE_NOT_SUPPORTED |
STATUS_PCP_LOCKED_OUT
The TPM has entered a dictionary-attack lockout state
STATUS_PCP_LOCKED_OUT reports a TPM-wide protection state rather than a failure of one application key. TPM anti-hammering limits repeated authorization failures to make password guessing impractical; when lockout is active, operations involving protected resources can be refused even if the next submitted secret would have been correct.
This is not a condition to cure with brute-force retries. The first priority is to stop automated attempts, identify the workflow producing them, and follow the platform's documented recovery or cooldown process. Clearing the TPM is a destructive administrative action with consequences for TPM-protected material.
What to check
- Preserve the failure timeline and identify every process that can access the TPM-backed key, including background services and scheduled tasks.
- Verify the user credential/PIN or authorization source outside the retry loop before resuming requests.
- Use supported administrative and vendor guidance for lockout recovery; document the effect on BitLocker, certificates, Windows Hello, and other dependent keys before changes.
References
- Microsoft: PCP and TPM error codes
- Microsoft: TPM fundamentals
- Trusted Computing Group: TPM 2.0 Library Specification
Looking for a different code? Search another status or error code.