What does HRESULT 0x80280044 (TPM_E_KEY_OWNER_CONTROL) mean?

TPM_E_KEY_OWNER_CONTROL

Owner-control policy blocks key eviction

TPM_E_KEY_OWNER_CONTROL (0x80280044) means the selected key is marked for owner-controlled eviction/persistence and the caller is using a path that is not authorized to perform that lifecycle change. The key can still be otherwise usable.

Evidence to capture

Capture key handle, owner-evict attribute, caller authorization path, command ordinal, and the key lifecycle operation being attempted. Confirm the handle refers to the expected persistent/loaded object.

Focused correction

Perform the lifecycle operation through the required owner-authorized path or leave the owner-controlled key resident as designed. Recreating the key changes identity and should not be the first diagnostic action.

Technical references

• Microsoft: Resource Virtualization in TBS.
• Microsoft: Command Scheduling in TBS.
• Microsoft: Using TPM Base Services.
• TCG: TPM 1.2 Part 3 — Context commands.