| Previous | Next |
| TPM_E_PER_NOWRITE | TPM_E_WRITE_LOCKED |
TPM_E_FAMILYCOUNT
The state machine behind the code
TPM_E_FAMILYCOUNT (0x80280040) belongs to TPM 1.2 nonvolatile-storage policy. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks a delegation blob or family operation carries a verification count that no longer matches the current TPM 1.2 family state.
Evidence table
| Question | Evidence for this HRESULT |
|---|---|
| What exact state was rejected? | a delegation blob or family operation carries a verification count that no longer matches the current TPM 1.2 family state |
| Which layer owns the result? | The TPM 1.2 NV permission and lifecycle checks. |
| What must be correlated? | family ID, family count in the TPM, count embedded in the blob, family create or invalidate history, and ownership changes |
| What is the controlled comparison? | retrieve current family state and build a fresh delegation blob tied to that count |
Separate caller data from platform state. The result caller data includes the command, structures, lengths, handles and flags; platform state includes TPM generation, provisioning, locality, lockout, resource inventory, firmware and the TBS service lifecycle. This result is actionable only after the rejected side is identified.
Reproduction plan
Use the following verification sequence:
- Capture the unmodified failing input and
0x80280040. - Retrieve current family state and build a fresh delegation blob tied to that count.
- Compare the first result divergent field or state transition.
- Repeat this result only after restoring the same baseline, with a bounded retry policy where the specification permits retry.
Contrast with neighboring results
| Other code | Why a different remedy follows |
|---|---|
TPM_E_WRITE_LOCKED | The NV area has already been written to — a separate checkpoint when compared with this result. |
TPM_E_PER_NOWRITE | There is no protection on the write to the NV area — a separate checkpoint when compared with it. |
TPM_E_BAD_ATTRIBUTES | The NV area attributes conflict — a separate checkpoint when compared with it. |
TPM_E_INVALID_FAMILY means the family identifier itself is not valid. The result difference determines whether to change serialization, authorization, resource lifetime, firmware/PPI state, command policy or only retry timing.
Confirming remediation
Correct the original boundary by choosing this direction: replace stale delegated credentials after any family-state change instead of editing the count field. Do not undefine a production NV index until its public attributes and authorization policy have been recorded. NV policy is established at definition time, and destructive recreation can remove counters, certificates or provisioning state.
A successful it outcome preserves the intended hardware trust boundary, passes the original request, and produces verifiable output. Masking it, swallowing this HRESULT or switching silently to a software provider is not remediation.
References used for this checkpoint
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — NV structures and permissions — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — NV commands — source for the checkpoint.
- Microsoft: Win32_Tpm class — source for the checkpoint.
Looking for a different code? Search another status or error code.