Bitlocker setup the max attemps before need the recovery code
I’m trying to configure Bitlocker with GPO for Windows 11 H2 workstations.
My need : after 4 wrong PIN code entered, the user must enter the recovery code.
I’ve tried these GPO, without success :
Computer Configuration > Administrative Templates > System > Trusted Platform Module Services
Standard User Individual Lockout Threshold : EnabledMaximum number of authorization failures per duration = 4Standard User Total Lockout Threshold : EnabledMaximum number of authorization failures per duration = 4
Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drivers
Allow enhanced PINs for startup : EnableConfigure minimum PIN length for startup : EnabledMinimum charcaters = 8
Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
Interactive logon: Machine account lockout threshold = 4
With PowerShell :
Get-Tpm
LockoutHealTime = 10 minutesLockoutMax = 31
Clear-Tpm
LockoutHealTime = 2 hoursLockoutMax = 10
I dont understand why the TPM value (lockoutMax) is 31. I want it equals 4. Where I’m wrong?
Thanks in advance
I’m trying to configure Bitlocker with GPO for Windows 11 H2 workstations.My need : after 4 wrong PIN code entered, the user must enter the recovery code. I’ve tried these GPO, without success : Computer Configuration > Administrative Templates > System > Trusted Platform Module ServicesStandard User Individual Lockout Threshold : EnabledMaximum number of authorization failures per duration = 4Standard User Total Lockout Threshold : EnabledMaximum number of authorization failures per duration = 4Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System DriversAllow enhanced PINs for startup : EnableConfigure minimum PIN length for startup : EnabledMinimum charcaters = 8Computer Configuration > Windows Settings > Security Settings > Local Policies > Security OptionsInteractive logon: Machine account lockout threshold = 4With PowerShell :Get-TpmLockoutHealTime = 10 minutesLockoutMax = 31 Clear-TpmLockoutHealTime = 2 hoursLockoutMax = 10 I dont understand why the TPM value (lockoutMax) is 31. I want it equals 4. Where I’m wrong? Thanks in advance Read More
