| Previous | Next |
| TPM_E_INVALID_AUTHHANDLE | TPM_E_INVALID_KEYUSAGE |
TPM_E_NO_ENDORSEMENT
Classify the layer correctly
TPM_E_NO_ENDORSEMENT (0x80280023) belongs to TPM 1.2 command processing. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the operation requires a provisioned TPM 1.2 Endorsement Key but the TPM has no usable EK at that checkpoint.
Incident worksheet
| Question | Evidence for this HRESULT |
|---|---|
| What exact state was rejected? | the operation requires a provisioned TPM 1.2 Endorsement Key but the TPM has no usable EK at that checkpoint |
| Which layer owns the result? | The TPM 1.2 command decoder and state machine. |
| What must be correlated? | EK presence and certificate information, ownership/provisioning state, manufacturer data, firmware events, and the exact command requiring endorsement hierarchy material |
| What is the controlled comparison? | query EK capability through supported platform tooling and compare with a known-provisioned device of the same model |
A reproducible comparison
Use the following verification sequence:
- Capture the unmodified failing input and
0x80280023. - Query ek capability through supported platform tooling and compare with a known-provisioned device of the same model.
- Compare the first result divergent field or state transition.
- Repeat this result only after restoring the same baseline, with a bounded retry policy where the specification permits retry.
Boundaries often confused with this one
| Other code | Why a different remedy follows |
|---|---|
TPM_E_INVALID_KEYUSAGE | The usage of a key is not allowed — a separate checkpoint when compared with this result. |
TPM_E_INVALID_AUTHHANDLE | An invalid handle was used — a separate checkpoint when compared with it. |
TPM_E_WRONG_ENTITYTYPE | The submitted entity type is not allowed — a separate checkpoint when compared with it. |
TPM_E_PERMANENTEK concerns an existing non-revocable EK, while this code reports that the required EK is absent. The result difference determines whether to change serialization, authorization, resource lifetime, firmware/PPI state, command policy or only retry timing.
Restore service safely
Correct the original boundary by choosing this direction: repair platform provisioning through the OEM or supported Windows workflow; do not generate an arbitrary software key and label it an EK. Do not clear ownership, delete keys or reset PCR-related state merely to see whether the message disappears; those actions can destroy the evidence and protected material while leaving serialization or command-order defects unchanged.
A successful it outcome preserves the intended hardware trust boundary, passes the original request, and produces verifiable output. Masking it, swallowing this HRESULT or switching silently to a software provider is not remediation.
References used for this checkpoint
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — Structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Commands — source for the checkpoint.
- Microsoft: TPM Base Services portal — source for the checkpoint.
Looking for a different code? Search another status or error code.