What does NTSTATUS 0xC0290004 (STATUS_TPM_AUDITFAILURE) mean?

 
Previous Next
STATUS_TPM_BAD_PARAMETER STATUS_TPM_CLEAR_DISABLED

STATUS_TPM_AUDITFAILURE

The TPM operation succeeded but its audit path failed

STATUS_TPM_AUDITFAILURE is a Windows NTSTATUS value mapped from the TPM facility. For STATUS_TPM_AUDITFAILURE, in this package the code belongs to TPM 1.2 style command processing, where Windows software, TBS, the TPM driver, and the hardware device all may be visible in the same failure path.

The relevant area is TPM command auditing. This status is unusual because the underlying TPM operation may have completed while the TPM could not build or record the audit information associated with that operation.

Treat it as a TPM audit-state problem, not as proof that the object operation itself failed. The diagnostic question is whether the caller depends on the audit trail for compliance or replay evidence. If so, the command result cannot be accepted blindly even if the protected operation changed TPM state.

Diagnostic focus

  • Separate the command side effect from the audit side effect in logs.
  • Check whether audit was enabled for this ordinal and whether the audit digest/state is already inconsistent.
  • For security-sensitive workflows, retry only after deciding how to handle a missing or failed audit record.

References for STATUS_TPM_AUDITFAILURE


Looking for a different code? Search another status or error code.