HRESULT 0x8028009D (TPM_20_E_POLICY_FAIL): meaning and diagnosis

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

the accumulated TPM policy session does not satisfy the authorization requirements.

Previous	Next
TPM_20_E_KEY	TPM_20_E_INTEGRITY

TPM_20_E_POLICY_FAIL

This response is about the completed authorization state of a policy session. The session may exist and individual policy commands may have succeeded, yet the final state does not meet the command's or entity's requirements. The TPM uses this response for mismatched policyDigest, cpHash or other required policy constraints.

Common mismatches

The policy command order, arguments, referenced names or policy digest differ from the authPolicy stored with the object or NV index.
A policy restricted to command parameters has a different cpHash than the command actually sent.
An operation requires a policy session or a specific policy command, but the assembled session was created for another role or command path.

What to compare byte-for-byte

Save the object public area, expected authPolicy, policy command sequence, policy digest after every step and the final command code and parameter hash. A trial policy is useful for reproducing digest construction, but it does not replace an authorization attempt against the current TPM state. Do not interpret this as an HMAC/password typo until the policy chain is shown to match.

TCG: policy digest and cpHash checks · tpm2_startauthsession · tpm2_policycommandcode

Looking for a different code? Search another status or error code.