> especially if a lockout policy is set on the TPM.

what happens at lockout?