| Previous | Next |
| TPM_E_MAXNVWRITES | TPM_E_RESOURCEMISSING |
TPM_E_NOOPERATOR
Technical interpretation
TPM_E_NOOPERATOR (0x80280049) belongs to TPM 1.2 resources, delegation and contexts. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks an operation requiring operator authorization was attempted before an operator AuthData value had been established.
The first producer to identify for this HRESULT is the TPM resource, context or delegation manager, sometimes mediated by TBS virtualization. TBS can virtualize finite TPM resources, but a saved TPM context and a TBS virtual handle are not durable application IDs. Their validity depends on resource type, owning client context, TPM lifecycle and the exact save/load history.
Inputs and state to capture
| Question | Evidence for this HRESULT |
|---|---|
| What exact state was rejected? | an operation requiring operator authorization was attempted before an operator AuthData value had been established |
| Which layer owns the result? | The TPM resource, context or delegation manager, sometimes mediated by TBS virtualization. |
| What must be correlated? | operator-auth provisioning state, command ordinal, physical-presence state, owner state, and the authorization form expected by the command |
| What is the controlled comparison? | query provisioning state and perform the workflow on a disposable test platform where operator authorization is deliberately configured |
A useful this result trace links three code-specific timelines: the application call, the local TBS/provider or firmware event, and the raw command/response exchange. The result timestamps should describe one attempt; combining data from separate retries is particularly misleading for authorization sessions, context counters, DAA stages and lockout state.
Validate without broad changes
The one-variable check is to query provisioning state and perform the workflow on a disposable test platform where operator authorization is deliberately configured. Record the before/after state that the result command is allowed to change. If the operation can have side effects, use a disposable key, session, counter or NV index rather than production material.
- Capture this result and
0x80280049at the first code-specific return boundary. - Decode the result state: handle namespace, owning context, save/load history, family state and resource lifetime.
- Run the result controlled comparison once and preserve both binary transcripts.
- Verify the expected this result output or state transition instead of relying on absence of a UI message.
Neighboring response codes
| Comparison code | Built-in distinction |
|---|---|
TPM_E_RESOURCEMISSING | The resource pointed to by context is not loaded — a separate checkpoint when compared with it. |
TPM_E_CONTEXT_GAP | The gap between saved context counts is too large — a separate checkpoint when compared with it. |
TPM_E_DELEGATE_LOCK | The delegate administration is locked — a separate checkpoint when compared with it. |
It specifically answers whether an operation requiring operator authorization was attempted before an operator AuthData value had been established. In contrast, TPM_E_NO_ENDORSEMENT concerns the EK, not the separate operator authorization value.
Fix and verify
To remediate it, provision operator authorization through the supported administrative process or avoid commands that require it. Do not persist volatile TPM or TBS handles as durable identifiers. A numeric handle can be valid only inside the creating context and lifecycle, even when its value looks unchanged after restart.
After correcting it, start with a fresh caller context where the protocol requires one, replay the original intended operation, and confirm that hardware-backed policy remains enforced.
Authoritative references
- Microsoft: Resource Virtualization in TBS — source for the checkpoint.
- Microsoft: Command Scheduling in TBS — source for the checkpoint.
- Microsoft: Using TPM Base Services — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Context commands — source for the checkpoint.
Looking for a different code? Search another status or error code.