So forget what you know about ATM PINs; this is a markedly different concept.
Yes.
TPMs have weaknesses, so this probably isn't a 100% guarantee depending on the attacker and the exact hardware, but it's pretty reliable (and very reliable if your attacker is reasonably small).
You can't set the number of bad attempts that trip lockout, or how long to lock out for differently for different objects -- those are global configuration parameters. But you can configure which objects / policies require DA protection and which ones don't.
I mean it's actually the same concept (something you have, something you know) with a different implementation.
Thanks, when windows moved to the PIN I was wondering how that worked/ they kept it secure but still easy to login.
But of course, Windows PIN was only needed when they made a local login a login to your Microsoft account, so your local password was suddenly transmitted to the internet.