How can I find out what caused a TPM lockout?
Jan 5
I am investigating a TPM lockout on my Windows machine. How can I find out what caused a TPM lockout?
My environment:
- Windows 11 24H2 Pro
- MSI GS76 Stealth 11UH laptop (mirror)
- Information from
tpm.msc:- TPM Specification Version: Your system is running 2.0.
- Manufacturer Name: The module is manufactured by INTC (Intel).
- Manufacturer Version: The specific firmware version is 600.7.0.0.
My situation:
- I don't recall entering incorrect PIN codes recently but I am not around my laptop 24/7 and I do have a cat.
- I had a recent laptop shutdown earlier in the day. I don't know what caused it.
So I don't know if the TPM lockout was caused by incorrect PIN codes, an unexpected laptop shutdown or something else. How can I find out what caused a TPM lockout?
1 answer
Accepted answer · original discussion
Jan 5
Use tpmtool gatherlogs %userprofile%\Desktop and check the TpmEvents.evtx event log it generates for clues. (From what I can tell, this basically does the same as filtering the Windows > System event viewer log for events from "TPM" and "TPM-WMI").
Causes for TPM locks could include Windows Hello auth failures, inadvertent power downs that increment the failed authentication register, typos at the prompt etc.
Installed any software or driver updates recently, including ones that updated any UEFI/BIOS?
Might be worth checking event viewer for any other Critical/Warning/Error level logs (filter the Windows logs), as suggested in this discussion on the MS community forums.
Other tools you can query to check the TPM is working correctly are get-tpm in an Administrator PowerShell, and the tpm.msc management console snap-in.
Some event IDs that might be pertinent include
- 14: TPM device driver encountered a non-recoverable error, preventing TPM services.
- 17: TPM hardware failed to execute a command.
- 1040: issue related to the TPM and Secure Boot
- 1796: another Secure Boot update issue ('not available', etc)
Related reading
0 question comments
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.