11

I've learned in this answer that starting with Windows 10 v1607, Windows will not allow to set, save or change the TPM owner password by default. So the option to reset a TPM lockout by entering the owner password does not appear to exist anymore.

enter image description here

The alternative is to clear the TPM. The following scenario:

  • BitLocker enabled with TPM + PIN
  • wrong PIN entered >256 times over some time
  • now TPM never allowes more than one PIN attempt before entering into lockout for several minutes
  • during TPM lockout, recovery key can be used to access system

Is it safe to clear the TPM to reset the counter of wrong PIN attempts? Will the BitLocker encrypted data be lost? The warning screen sounds serious (below).

As mentioned, the recovery key is available. However, I want to avoid having to enter it every time I boot the computer.

enter image description here

Community
  • 1
u17
  • 539
  • 2
  • 4
  • 14
  • You should decrypt the drive before you do anything with the TPM which is storing keys for your TPM – Ramhound Nov 25 '16 at 21:42
  • "during TPM lockout, recovery key can be used to access system" If that is the case, why don't you just use the recovery key? Or did you mean "during TPM lockout, recovery key can **not** be used..." ? – sleske Nov 25 '16 at 22:54
  • @sleske: The recovery key *can* be used but I don't want to remember the recovery key in my head. Right now, I keep it close to the computer on a piece of paper to use every time I mistype the PIN again. I would like to reset the counter of wrong PIN attempts. – u17 Nov 25 '16 at 23:03
  • @FrankSeifert: Thanks for the clarification, I have edited it into your question. Once you have cleared the chip, you can set a new TPM PIN. Answer edited. – sleske Nov 25 '16 at 23:12

2 Answers2

13

tl;dr:

Is it safe to clear the TPM to reset the counter of wrong PIN attempts?

Only if you have the BitLocker recovery key. If you clear the TPM, the encrypted drive will only be accessible using the recovery key.

So in your case it should be ok to clear the TPM chip. Afterwards, reboot and enter the recovery key. Once inside Windows, you can re-enable the TPM chip and set a new PIN.

Longer explanation:

BitLocker usually (see below for exception) uses the computer's TPM chip to store the key required for decrypting the boot drive. If the TPM chip is cleared, this key is lost (for ever). In that case, the only way to decrypt the drive is to use the BitLocker recovery key - it exists specifically for cases like this.

In practice, if you boot from a drive encrypted with BitLocker, and Windows finds it cannot retrieve the keys from the TPM chip, it will prompt you for the recovery key. You will get an ugly black & white screen asking for the key. If you enter the right key, Windows will boot normally. If you cannot enter the key - bad luck.

For more information about how BitLocker works, also see this question on serverfault.com: TPM had to be reintialized: Does a new recovery password have to be uploaded to AD?

Note:

It is possible to use BitLocker without TPM, though the option needs to be enabled first. In that case, clearing the TPM will not make a difference. However, it looks like you are using BitLocker with TMP, so this does not apply in your case.

Community
  • 1
sleske
  • 22,652
  • 10
  • 69
  • 93
4

Yes, the TPM can be safely cleared when the recovery key is available. In further support of @sleske's answer, here are excerpts from a Technet article on Bitlocker recovery.

What causes BitLocker recovery?

The following list provides examples of specific events that will cause BitLocker to enter recovery mode when attempting to start the operating system drive:

  • Turning off, disabling, deactivating, or clearing the TPM.

 

What is BitLocker recovery?

BitLocker recovery is the process by which you can restore access to a BitLocker-protected drive in the event that you cannot unlock the drive normally. In a recovery scenario you have the following options to restore access to the drive:

  • The user can supply the recovery password. If your organization allows users to print or store recovery passwords, the user can type in the 48-digit recovery password that they printed or stored on a USB drive or with your Microsoft Account online.

 

u17
  • 539
  • 2
  • 4
  • 14