| Previous | Next |
| TPM_E_DUPLICATE_VHANDLE | TPM_E_EMBEDDED_COMMAND_UNSUPPORTED |
TPM_E_EMBEDDED_COMMAND_BLOCKED
What failed and what did not
TPM_E_EMBEDDED_COMMAND_BLOCKED means TBS permitted the outer legacy transport but blocked the TPM command embedded inside it.
The first producer to identify is TBS command blocking, virtual-handle translation, retry or anti-hammering logic. Windows TBS schedules and mediates commands from multiple clients. It can block commands, translate virtual handles, request retry, and preserve anti-hammering policy before or after the raw device command path.
Collect a useful trace
| Question | Evidence |
|---|---|
| What exact state was rejected? | TBS permitted the outer legacy transport but blocked the TPM command embedded inside it |
| Which layer owns the result? | TBS command blocking, virtual-handle translation, retry or anti-hammering logic. |
| What must be correlated? | outer transport command, embedded ordinal, caller privilege, command-blocking policy, transport attributes, and OS version |
| Controlled comparison | submit the embedded operation directly in a test context to determine whether policy blocks that ordinal independently |
Separate caller data from platform state. The caller data includes the command, structures, lengths, handles and flags; platform state includes TPM generation, provisioning, locality, lockout, resource inventory, firmware and the TBS service lifecycle. This result is actionable only after the rejected side is identified.
Narrow experiment
Use the following verification sequence:
- Capture the unmodified failing input and
0x80280403. - Submit the embedded operation directly in a test context to determine whether policy blocks that ordinal independently.
- Compare the first divergent field or state transition.
- Repeat the operation only after restoring the same baseline, with a bounded retry policy where the specification permits retry.
Similar-looking outcomes
| Other code | Why a different remedy follows |
|---|---|
TPM_E_EMBEDDED_COMMAND_UNSUPPORTED | The command within the transport is not supported. |
TPM_E_DUPLICATE_VHANDLE | The TPM returned a duplicate handle and the command needs to be resubmitted. |
TPM_E_RETRY | The TPM is too busy to respond to the command immediately, but the command could be resubmitted at a later time. |
TPM_E_COMMAND_BLOCKED applies when the outer command itself is denied. The difference determines whether to change serialization, authorization, resource lifetime, firmware/PPI state, command policy or only retry timing.
Operational response
Correct the original boundary by choosing this direction: replace the blocked embedded operation with an allowed workflow or remove the obsolete transport design. Do not disable command policy globally to make one test pass. First establish the caller, command code and supported higher-level alternative, because command blocking is a security boundary.
Technical references
Looking for a different code? Search another status or error code.