| Previous | Next |
| TPM_E_BAD_HANDLE | TPM_E_BADCONTEXT |
TPM_E_BAD_DELEGATE
Interpret the boundary first
TPM_E_BAD_DELEGATE (0x80280059) belongs to TPM 1.2 resources, delegation and contexts. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the TPM 1.2 delegation blob or row is invalid for the requested authorized operation.
Build the command transcript
| Question | Evidence for this HRESULT |
|---|---|
| What exact state was rejected? | the TPM 1.2 delegation blob or row is invalid for the requested authorized operation |
| Which layer owns the result? | The TPM resource, context or delegation manager, sometimes mediated by TBS virtualization. |
| What must be correlated? | delegation type, family ID and count, row label, permissions, integrity digest, entity binding, and owner lifecycle |
| What is the controlled comparison? | decode and verify a newly issued delegation, then use it once for the intended command |
Record the original command or API call before this result retry logic mutates its nonces, handles, buffers or state. Also retain the full HRESULT as 0x80280059; signed decimal logging can hide the result TPM/TBS facility and make searches less precise.
Test one hypothesis
- Establish the result baseline with the same device, Windows build, account and TPM generation.
- Perform one narrow experiment: decode and verify a newly issued delegation, then use it once for the intended command.
- Compare raw this result inputs and the first response, not only the final application dialog.
- Stop after the first changed the checkpoint; a later error means this boundary was passed even if the whole workflow still fails.
Do not merge these conditions
| Result | Different diagnostic question |
|---|---|
TPM_E_BADCONTEXT | The context blob is invalid — a separate checkpoint when compared with this result. |
TPM_E_BAD_HANDLE | The handle is incorrect — a separate checkpoint when compared with it. |
TPM_E_TOOMANYCONTEXTS | Too many contexts held by the TPM — a separate checkpoint when compared with it. |
The decisive distinction for this HRESULT is that TPM_E_DELEGATE_FAMILY identifies a family mismatch; this code covers the delegation object more generally. The short platform wording — “Delegation is not correct.” — does not supply that differential diagnosis by itself.
A safe recovery path
The corrective direction is to replace stale or corrupted delegation data and issue only the permissions required by the operation. Do not persist volatile TPM or TBS handles as durable identifiers. A numeric handle can be valid only inside the creating context and lifecycle, even when its value looks unchanged after restart.
A verified it repair reproduces the original request with the same intended security policy and passes this checkpoint. Replacing it with a broader wrapper status, silently falling back to software keys, or suppressing verification is not proof of success.
Technical references
- Microsoft: Resource Virtualization in TBS — source for the checkpoint.
- Microsoft: Command Scheduling in TBS — source for the checkpoint.
- Microsoft: Using TPM Base Services — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Context commands — source for the checkpoint.
Looking for a different code? Search another status or error code.