| Previous | Next |
| TPM_E_SHA_THREAD | TPM_E_FAILEDSELFTEST |
TPM_E_SHA_ERROR
Which layer owns this HRESULT
TPM_E_SHA_ERROR (0x8028001B) belongs to TPM 1.2 command processing. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks an existing TPM 1.2 SHA-1 thread has become unusable, so later update or completion work cannot continue.
The first producer to identify for it is the TPM 1.2 command decoder and state machine. TPM 1.2 is a command/response device with strict binary structures and stateful resources. Windows may present the device response as an HRESULT, but the diagnostic meaning still belongs to the command field, key, session, PCR, NV index or lifecycle check named by the TPM specification.
Diagnostic record
Preserve these this result items before changing anything:
- This result and
0x8028001B, the exact returning method or command, and the first nested status. - the first failing chunk, total byte count promised at start, update sizes, completion command, and whether the device slept or the context was closed.
- The TPM generation, manufacturer/firmware revision, Windows build, caller identity and TBS/provider state for it.
- The complete opaque request artifacts, redacting authorization secrets but not rewriting structure boundaries.
How to verify the distinction
Run this focused check: repeat with the same data in a fresh SHA thread and fixed chunk boundaries, stopping at the first command that changes the state. Do not combine the result test with firmware updates, TPM clearing, account changes, key recreation and policy edits in the same trial; such a result cannot isolate this boundary.
| Checkpoint | Pass condition |
|---|---|
| an existing TPM 1.2 SHA-1 thread has become unusable, so later update or completion work cannot continue | The original this result command reaches the next defined state without returning it. |
| Security behavior | The result verification still uses the intended TPM, authorization, locality and policy. |
| Output integrity | The object, digest, event log or state transition produced after it validates independently. |
Common false equivalences
| Related result | Separate meaning |
|---|---|
TPM_E_BADTAG | The tag value sent to for a command is invalid — a separate checkpoint when compared with it. |
TPM_E_SHA_THREAD | There is no existing SHA-1 thread — a separate checkpoint when compared with it. |
TPM_E_IOERROR | An IO error occurred transmitting information to the TPM — a separate checkpoint when compared with it. |
The practical distinction is that TPM_E_SHA_THREAD indicates that no thread exists; it indicates a thread whose prior operation already failed.
What a real fix looks like
The supported direction is to discard the failed thread and correct the earlier length, sequencing, or transport problem before starting a new hash. Do not clear ownership, delete keys or reset PCR-related state merely to see whether the message disappears; those actions can destroy the evidence and protected material while leaving serialization or command-order defects unchanged.
If the same bytes still return it after the documented preconditions are satisfied, retain this code-specific trace for the platform vendor or Windows component owner rather than erasing state.
Technical references
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — Structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Commands — source for the checkpoint.
- Microsoft: TPM Base Services portal — source for the checkpoint.
Looking for a different code? Search another status or error code.