Are there any restrictions?

• None of the TPM modes allow Workstations to be adopted into an ESET Endpoint Encryption Server (EEE Server). If a Workstation is deleted or a Workstation needs to be transferred from one EEE Server to another, they will have to be decrypted first.
• You will not be able to change authentication mode without fully decrypting the Workstation first. This also applies to encrypted Workstations that are not using a TPM mode that have been upgraded to the latest version of ESET Endpoint Encryption.
• TPM encryption is only available via an EEE Server, it is not supported on an unmanaged client.
• If you 'Clear' the TPM, all the current encryption keys being stored will be lost and the Workstation will not be able to boot. If you 'Clear' the TPM after encryption you will need to use the recovery ISO from the EEE Server: KB346 - Full Disk Encryption Recovery Overview

Disaster recovery

• In the event of a hardware or Windows fault, you will need to decrypt the disk using the FDE Recovery Image from the EEE Server: KB346 - Full Disk Encryption Recovery Overview
• You can not move the disk to another physical Workstation and boot it, due to the TPM security.
• In the event that your EEE Server host machine is inaccessible, you will lose the ability to create recovery ISO's in order to manually decrypt your TPM enabled Workstations.

Are there any things I need to be careful of?

You must be very careful with the TPM. If you Clear it, attempt to change the Owner password or have it changed due to hardware failure, you will be unable to correctly boot the Workstation and will need to decrypt the disk.

Is there anything I should do?

Keeping regular file level backups of your data is important. It is usually much faster and simpler to restore your back up files than it is to decrypt data, especially if the disk or data is damaged or partially corrupted.

This applies to both the encrypted Workstation as well as your EEE Server.

KB63 - How do I backup my data? 

How many attempts do I get to log in?

ESET Endpoint Encryiption TPM support uses Active Directory Group Policy settings.

The Default Workstation retries value varies from 32 to 31 (Windows 10 Creators edition) and could vary in other O/S updates, or in other environments.

The "interval" value is the number of times each retry stays active. (Default is 2 hours)

How this works is if you have an interval value of 2 hours and set the number of retries to 31 and use them all then it will take 2 hours to be able to have one more attempt, or wait 4 hours in order to have two more attempts.

This is fully reset by doing a TPM PIN/Password recovery: KB446 - TPM Recovery

Related Articles

KB442 - Starting Full Disk Encryption using a TPM (Trusted Platform Module)

KB430 - Trusted Platform Module (TPM) Support

Keywords: Full Disk Encryption start initiate hard drive whole tpm transparent pin