| Previous | Next |
| TPM_E_INVALID_FAMILY | TPM_E_REQUIRES_SIGN |
TPM_E_NO_NV_PERMISSION
Meaning beyond the built-in message
TPM_E_NO_NV_PERMISSION means the authorization path does not grant the read, write, define or release operation requested for a TPM 1.2 NV index.
The first producer to identify is the TPM 1.2 NV permission and lifecycle checks. TPM 1.2 NV indices combine permissions, authorization mode, locality masks and lock semantics. Two indices of the same size can behave differently because those attributes were fixed when each index was defined.
Decode the relevant state
Preserve these items before changing anything:
- This result and
0x80280038, the exact returning method or command, and the first nested status. - NV index, permission attributes, read/write locality, auth mode, owner or index authorization, lock bits, and requested offset and length.
- Record the TPM generation, manufacturer/firmware revision, Windows build, caller identity, and TBS/provider state.
- The complete opaque request artifacts, redacting authorization secrets but not rewriting structure boundaries.
One-variable test
Run this focused check: read public NV metadata first and test the same operation on a disposable index with known permissions. Do not combine the test with firmware updates, TPM clearing, account changes, key recreation and policy edits in the same trial; such a result cannot isolate this boundary.
| Stage | Pass condition |
|---|---|
| the authorization path does not grant the read, write, define or release operation requested for a TPM 1.2 NV index | The original command reaches the next defined state without returning it. |
| Security behavior | Verification still uses the intended TPM, authorization, locality and policy. |
| Output integrity | The object, digest, event log or state transition produced after it validates independently. |
Differential diagnosis
| Related result | Separate meaning |
|---|---|
TPM_E_REQUIRES_SIGN | The operation requires a signed command. |
TPM_E_INVALID_FAMILY | The command is attempting to use an invalid family ID. |
TPM_E_KEY_NOTSUPPORTED | Wrong operation to load an NV key. |
The practical distinction is that TPM_E_AREA_LOCKED and TPM_E_WRITE_LOCKED concern current lock state; it concerns permission.
Supported corrective direction
The supported direction is to use the authorization and locality encoded when the index was defined, or redefine only a disposable index with appropriate attributes. Do not undefine a production NV index until its public attributes and authorization policy have been recorded. NV policy is established at definition time, and destructive recreation can remove counters, certificates or provisioning state.
Technical references
- TCG: TPM 1.2 Main Specification — source for this result.
- TCG: TPM 1.2 Part 2 — NV structures and permissions — source for this result.
- TCG: TPM 1.2 Part 3 — NV commands — source for this result.
- Microsoft: Win32_Tpm class — source for this result.
Looking for a different code? Search another status or error code.