[ltsb, 1607] Bitlocker Recovery Key - sending to remote user...

[Koldov]

I have received an email from a member of SLT asking if I can help a teacher that seems to have somehow entered the Bitlocker password incorrectly enough times to lock her laptop.

 

Now, this user has done this a few times...

 

I have read that you should get something like 3 chances before it locks, I have also read that you can wait a period of time and this resets, but we have waited a day and it hasn't.

 

After rebooting this is now locking even when the correct password is entered!

 

Question is, what can I do remotely...?

 

I can access our server and copy the recovery key and send that to her.... but how much of a security risk is that?

[Koldov]

https://www.dell.com/support/article/en-uk/sln304487/tpm-failure-tries-recovery-time-and-lockout-recovery?lang=en

 

TPM 1.2

 

It seems the TPM can accept 13 incorrect tries a day and then resets after 24 hours, but I have read that some TPM chips retain all incorrect tries and increment them over time without resetting.

 

As this laptop has had this 'user issue' numerous times and not reset itself I believe this is the case.

 

I have also found this bit of information:

 

"Reset both the failure tries and the lockout state by using the Microsoft TPM Management Console with correct owner password."

 

However the TPM owner password isn't saved anywhere...

Edited May 12, 2020 by Koldov

[k-strider]

ive had to do this twice since lockdown...

[Koldov]

Well, I have told the user to wait for a day and try again, just in case it clears.

 

If not I will have to send them the recovery key I guess...