| Previous | Next |
| TPM_E_MA_AUTHORITY | TPM_E_BAD_SIGNATURE |
TPM_E_PERMANENTEK
Locate the first producer
TPM_E_PERMANENTEK (0x80280061) belongs to TPM 1.2 key migration and endorsement policy. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the request tries to revoke or replace an Endorsement Key that the TPM 1.2 device marks as permanent and non-revocable.
The first producer to identify for it is the certified-migration, key-policy or EK administrative checkpoint. TPM 1.2 migration policy is encoded when a key is created and reinforced by signed authority tickets and source/destination bindings. Migration errors therefore require the original binary artifacts and key attributes, not only the user-visible key name.
Data to retain
Preserve these this result items before changing anything:
- This result and
0x80280061, the exact returning method or command, and the first nested status. - EK attributes, manufacturer and firmware data, revocability capability, physical-presence state, and the exact administrative command.
- The TPM generation, manufacturer/firmware revision, Windows build, caller identity and TBS/provider state for it.
- The complete opaque request artifacts, redacting authorization secrets but not rewriting structure boundaries.
Verification sequence
Run this focused check: query EK and manufacturer capability without issuing destructive operations and compare with vendor documentation. Do not combine the result test with firmware updates, TPM clearing, account changes, key recreation and policy edits in the same trial; such a result cannot isolate this boundary.
| Checkpoint | Pass condition |
|---|---|
| the request tries to revoke or replace an Endorsement Key that the TPM 1.2 device marks as permanent and non-revocable | The original this result command reaches the next defined state without returning it. |
| Security behavior | The result verification still uses the intended TPM, authorization, locality and policy. |
| Output integrity | The object, digest, event log or state transition produced after it validates independently. |
Codes that answer different questions
| Related result | Separate meaning |
|---|---|
TPM_E_BAD_SIGNATURE | Bad signature of CMK ticket — a separate checkpoint when compared with it. |
TPM_E_MA_AUTHORITY | Incorrect migration authority — a separate checkpoint when compared with it. |
TPM_E_MA_SOURCE | Migration source incorrect — a separate checkpoint when compared with it. |
The practical distinction is that TPM_E_NO_ENDORSEMENT reports that an EK is missing rather than permanently fixed.
Exit condition for the incident
The supported direction is to accept the permanent EK design or follow an OEM-supported replacement process for the platform; software retries cannot make it revocable. Do not edit a signed ticket, migration blob or opaque private-key structure. Binary normalization, JSON conversion or base64 line handling can invalidate the authority and integrity relationships.
If the same bytes still return it after the documented preconditions are satisfied, retain this code-specific trace for the platform vendor or Windows component owner rather than erasing state.
Technical references
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — Certified migration structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Migration commands — source for the checkpoint.
- Microsoft: How Windows uses the TPM — source for the checkpoint.
Looking for a different code? Search another status or error code.