Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0.
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Server 2016, Windows 10 Version 1703
Path in the GPO console
Computer Configuration\Administrative Templates\System\Trusted Platform Module Services Description
This policy setting configures the TPM to use the Dictionary Attack Prevention Parameters (lockout threshold and recovery time) to the values that were used for Windows 10 Version 1607 and below. Setting this policy will take effect only if a) the TPM was originally prepared using a version of Windows after Windows 10 Version 1607 and b) the System has a TPM 2.0. Note that enabling this policy will only take effect after the TPM maintenance task runs (which typically happens after a system restart). Once this policy has been enabled on a system and has taken effect (after a system restart), disabling it will have no impact and the system's TPM will remain configured using the legacy Dictionary Attack Prevention parameters, regardless of the value of this group policy. The only way for the disabled setting of this policy to take effect on a system where it was once enabled is to a) disable it from group policy and b)clear the TPM on the system.
Registry
Software\Policies\Microsoft\TPM Value name: UseLegacyDictionaryAttackParameters
Enabled: UseLegacyDictionaryAttackParameters = 1
Disabled: UseLegacyDictionaryAttackParameters = 0
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_TPM/UseLegacyDAP_Name Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0.
; State: Enabled
; Supported on: At least Windows Server 2016, Windows 10 Version 1703
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\TPM]
"UseLegacyDictionaryAttackParameters"=dword:00000001More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0.
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1703
$path = 'HKLM:\Software\Policies\Microsoft\TPM'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'UseLegacyDictionaryAttackParameters' -Value 1 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_TPM/UseLegacyDAP_Name
Data type: String
Value:
<enabled/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0.
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1703
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\TPM' -Name 'UseLegacyDictionaryAttackParameters' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0.
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1703
$path = 'HKLM:\Software\Policies\Microsoft\TPM'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'UseLegacyDictionaryAttackParameters' -Value 1 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0.
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1703
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0.
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1703
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\TPM' -Name 'UseLegacyDictionaryAttackParameters' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0.
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1703
$path = 'HKLM:\Software\Policies\Microsoft\TPM'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'UseLegacyDictionaryAttackParameters' -Value 1 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.