What does HRESULT 0x80280005 (TPM_E_CLEAR_DISABLED) mean?

TPM_E_CLEAR_DISABLED

TPM_E_CLEAR_DISABLED reports a TPM 1.2 clear-policy restriction. The device is not necessarily disabled and its keys are not necessarily corrupt; the attempted clear path is blocked because the clear-disable state requires an authorization method such as physical presence.

Clearing is destructive: it can remove TPM ownership state and invalidate protected keys or data. This result should therefore be handled as an administrative-policy boundary, not as an instruction to keep retrying from the operating system.

Safe response

• Identify the exact clear command and the platform’s approved physical-presence or firmware workflow.
• Inventory dependent protectors, certificates, and recovery material before any ownership or clear action.
• Differentiate a blocked clear from TPM_E_DISABLED (module disabled) and TPM_E_DEACTIVATED (deactivated state). Those conditions have different remediation paths.

In managed fleets, follow the organization’s firmware and recovery process rather than changing TPM state from an application error handler.

References

• Microsoft: TPM HRESULT values in Winerror.h
• TCG TPM 1.2 Part 3: Commands
• Microsoft: TPM 1.2 command-management reference