Will clearing the TPM make BitLocker encrypted data unavailable?

Solution 1:

tl;dr:

Is it safe to clear the TPM to reset the counter of wrong PIN attempts?

Only if you have the BitLocker recovery key. If you clear the TPM, the encrypted drive will only be accessible using the recovery key.

So in your case it should be ok to clear the TPM chip. Afterwards, reboot and enter the recovery key. Once inside Windows, you can re-enable the TPM chip and set a new PIN.

Longer explanation:

BitLocker usually (see below for exception) uses the computer's TPM chip to store the key required for decrypting the boot drive. If the TPM chip is cleared, this key is lost (for ever). In that case, the only way to decrypt the drive is to use the BitLocker recovery key - it exists specifically for cases like this.

In practice, if you boot from a drive encrypted with BitLocker, and Windows finds it cannot retrieve the keys from the TPM chip, it will prompt you for the recovery key. You will get an ugly black & white screen asking for the key. If you enter the right key, Windows will boot normally. If you cannot enter the key - bad luck.

For more information about how BitLocker works, also see this question on serverfault.com: TPM had to be reintialized: Does a new recovery password have to be uploaded to AD?

Note:

It is possible to use BitLocker without TPM, though the option needs to be enabled first. In that case, clearing the TPM will not make a difference. However, it looks like you are using BitLocker with TMP, so this does not apply in your case.

Solution 2:

Yes, the TPM can be safely cleared when the recovery key is available. In further support of @sleske's answer, here are excerpts from a Technet article on Bitlocker recovery.

What causes BitLocker recovery?

The following list provides examples of specific events that will cause BitLocker to enter recovery mode when attempting to start the operating system drive:

• Turning off, disabling, deactivating, or clearing the TPM.

What is BitLocker recovery?

BitLocker recovery is the process by which you can restore access to a BitLocker-protected drive in the event that you cannot unlock the drive normally. In a recovery scenario you have the following options to restore access to the drive:

• The user can supply the recovery password. If your organization allows users to print or store recovery passwords, the user can type in the 48-digit recovery password that they printed or stored on a USB drive or with your Microsoft Account online.