Dual Boot Windows 11 / Ubuntu 25.04 with TPM / DA lockout mode

Support and Help
,
1

Hello

I have setup my PC to run with Dualboot (from the BIOS) with 2 SSDs.

  • The first SSD has Windows 11 installed with Bitlocker activated. Decryption key stored in TPM.
  • The second SSD has Ubuntu 25.04 installed. Disk is encrypted LUKS. Need to enter Decription Password at boot.

Now I wanted to reinstall Ubuntu to use TPM. When starting the installer, it shows me that “TPM is in DA lockout mode”

Searching this issue, it most often says, that the TPM needs to be deleted. But in this case I will loose the bitlocker keys

Questions:

  • Is Dual-Boot with Ubuntu+TPM and Windows-Bitlocker-TPM possible?
  • If I delete the TPM, will I lose the Bitlocker keys? Or can I restore them with the recovery key?
  • Can I enable TPM on Ubuntu without full install?

Thanks for your help!

2

Yes. A single TPM can store several independent blobs, so Windows can keep its BitLocker key there while Ubuntu stores a LUKS-unlock key of its own.

Why does the Ubuntu installer say “TPM is in DA lock-out mode”?

“DA” = Dictionary-Attack. Too many bad authorization attempts (often from previous experiments) have temporarily locked the TPM. The firmware can’t write new keys until the lock clears.

Most boards clear the lock after a power-cycle or a set time (e.g. 24 hours).
If it stays locked you’ll need to Clear / Reset the TPM from the firmware setup.

Will clearing the TPM erase my BitLocker key

It wipes the sealed copy inside the TPM, not your data.
Boot Windows once with the BitLocker recovery key, then BitLocker will reseal a fresh copy of its key into the new TPM. So:

  1. Back up your 48-digit BitLocker recovery key first!
  2. Clear / reset the TPM in UEFI Setup (or tpm.msc > Clear TPM).
  3. Boot Windows - it asks for the recovery key once - BitLocker resumes - key is resealed automatically.

No files are lost.

From your existing Ubuntu you can bind the LUKS volume to the TPM in one command:

sudo systemd-cryptenroll /dev/nvme0n1pX --tpm2

(replace /dev/nvme0n1pX with your LUKS partition)

That stores a random unlock key in the TPM and adds a new tpm2 entry to your LUKS header. Then edit /etc/crypttab so the volume is unlocked via TPM at boot.

Tips for a smooth dual-boot setup

Keep Secure Boot either on for both OSes or off for both.
Different Secure-Boot states change PCR 7, and a mismatched PCR will block TPM-based unlock.
When enrolling with systemd-cryptenroll, you can restrict the PCR set:

--tpm2-pcrs=0+2  # common choice that works for both Windows and Linux boots

Always keep an emergency LUKS passphrase (and your BitLocker recovery key) somewhere safe in case firmware updates or PCR changes lock you out.

Bottom line

  1. Make sure you have the BitLocker recovery key.
  2. Clear the TPM (this removes the DA lockout).
  3. Boot Windows once with the recovery key so BitLocker reseals.
  4. From Ubuntu, use systemd-cryptenroll … --tpm2 to add a TPM-unlock entry to your LUKS disk no reinstall needed. Happy dual-booting!
3

The (still experimental) TPM mode in the installer is actually inherited from our UbuntuCore IoT system which is not designed for any dual boot setups (IoT or industrial devices usually come with a single OS only and have no need for dual booting), so it is still rather weak on that side (this is supposed to become better with the next LTS) …

If you actually want TPM supported disk encryption will have to do it following some manual HOWTO like @thingizkhan described above (or following some other tutorial, I guess there are several out there) or simply resort to the manual way by typing in an encryption password without TPM.

1 Like
4

Hi @ogra & @thingizkhan

Thanks for your replies. Personally I think the DA status is not detected correctly, as I didn’t do anything with the TPM at all.

Anyways, when I bootet in Ubuntu 25.04 I was able to enroll the key with the command

sudo systemd-cryptenroll /dev/nvmeXnYpZ --tpm2-device=auto --tpm2-pcrs=0,7

running systemd-cryptenroll /dev/nvmeXnYpZ shows the tpm2 entry, so I expect this works.

Then I modified /etc/crypttab that it looks like

dm_crypt-0 UUID=XXXXXXXXXXXXX none tpm2-device=auto,luks,tpm2-pcrs=0+7

I find guides which use dracut - but according to my reading, latest ubuntu use initramfs - so when running the update command after editing I get the warning that the tpm2 options are unknown.

sudo update-initramfs -u
update-initramfs: Generating /boot/initrd.img-6.14.0-15-generic
cryptsetup: WARNING: dm_crypt-0: ignoring unknown option 'tpm2-device'
cryptsetup: WARNING: dm_crypt-0: ignoring unknown option 'tpm2-pcrs'

After this, when I reboot I still need to enter the password manually.

I think Bug #1980018 “Cryptsetup-initramfs cant deal with tpm2-device op...” : Bugs : cryptsetup package : Ubuntu is related to this, and so my understanding is, that it is not working right now with initramfs

Thanks

5

Well, that’s a very simple one … if you look at:

You will find that the systemd-cryptsetup in Ubuntu is simply not compiled with TPM2 support turned on …

I would assume this is because systemd is not used at all in Ubuntus initrd yet … this is about to change on the way to 26.04 LTS when the distro will switch to systemd based initramfs and dracut …

Though I’m still not sure it will be turned on at all since as you can see in the bug you linked handling of unsealed initramfses is considered insecure (to quote the marvelous steve langasek it is a “security theater”), see the comment number 19 in the bug, that explains the concerns pretty well:

1 Like
6

@ogra many thanks for your time and detailed explanation. Based on your information I will wait until 26.04 is released and see if it works by then :slight_smile: It’s not really a killer feature, would have been a nice to have :wink:

Also thanks for the linked comment. So it makes for sure to wait for a proper implementation in the release instead of trying to patch & hack the system to make it maybe less secure :wink:

7

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.