| Previous | Next |
| TBS_E_SERVICE_NOT_RUNNING | TBS_E_TOO_MANY_RESOURCES |
TBS_E_TOO_MANY_TBS_CONTEXTS
Which layer owns this HRESULT
TBS_E_TOO_MANY_TBS_CONTEXTS (0x80284009) belongs to TBS resource virtualization. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks TBS cannot allocate another client context because the service context limit has been reached.
The first producer to identify for it is the TBS context and virtual-resource manager that maps finite TPM slots for multiple clients. TBS resource virtualization maps client-visible virtual handles to finite physical TPM key, authorization and transport slots. Cleanup, eviction and context ownership determine whether a mapping can be restored.
The result value 0x80284009 should remain attached to the symbolic name. Some this result logs store the value as a negative signed integer; others expose only a generic CNG, WMI, BitLocker or enrollment message. Neither substitution identifies the TBS cannot allocate another client context because the service context limit has been reached as precisely as it.
Diagnostic record
- Producer for it: the TBS context and virtual-resource manager that maps finite TPM slots for multiple clients.
- Rejected invariant: TBS cannot allocate another client context because the service context limit has been reached.
- Decisive capture: number of open contexts by process, leaked handles, service diagnostics, application concurrency, context close paths, and recent crashes.
- Safe comparison: close one disposable context and verify that another can be created without restarting the service.
How to verify the distinction
Build the result minimal case around the original command contract. Use a disposable object when the request can write NV data, advance a counter, change authorization state or consume a lock transition. The comparison is valid only when the caller, TPM generation and security policy remain the same.
| Question | Evidence for it |
|---|---|
| What exact state was rejected? | TBS cannot allocate another client context because the service context limit has been reached |
| Which layer owns the result? | The TBS context and virtual-resource manager that maps finite TPM slots for multiple clients. |
| What must be correlated? | number of open contexts by process, leaked handles, service diagnostics, application concurrency, context close paths, and recent crashes |
| What is the controlled comparison? | close one disposable context and verify that another can be created without restarting the service |
Common false equivalences
| Constant | Checkpoint represented by its standard message |
|---|---|
TBS_E_TOO_MANY_RESOURCES | A new virtual resource could not be created because there are too many open virtual resources — a separate checkpoint when compared with this result. |
TBSIMP_E_INVALID_CONTEXT_HANDLE | The specified context handle is invalid — a separate checkpoint when compared with this result. |
TBSIMP_E_INVALID_CONTEXT_PARAM | An invalid context parameter was specified — a separate checkpoint when compared with it. |
The codes above may appear in the same workflow, but they are not aliases. TBSIMP_E_TOO_MANY_TBS_CONTEXTS is the internal implementation form of the same resource boundary.
What a real fix looks like
Pair every successful create with close and pool contexts only where the api design allows it. Do not confuse a TBS virtual handle with a physical TPM handle or copy it to another process. Resource virtualization intentionally scopes mappings to a client context.
Proof for it consists of a successful replay plus validation of the intended key, PCR, NV, context, event-log, provider or service result. A software fallback or a newly provisioned blank TPM answers a different question than it.
Source material
- Microsoft: Resource Virtualization in TBS — source for the checkpoint.
- Microsoft: Command Scheduling in TBS — source for the checkpoint.
- Microsoft: About TPM Base Services — source for the checkpoint.
- Microsoft: Power Management in TBS — source for the checkpoint.
Looking for a different code? Search another status or error code.