| Previous | Next |
| TPM_E_AUTH2FAIL | TPM_E_IOERROR |
TPM_E_BADTAG
What failed and what did not
TPM_E_BADTAG (0x8028001E) belongs to TPM 1.2 command processing. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the request header tag does not match a valid TPM 1.2 command form or its expected authorization-session count.
The first producer to identify for it is the TPM 1.2 command decoder and state machine. TPM 1.2 is a command/response device with strict binary structures and stateful resources. Windows may present the device response as an HRESULT, but the diagnostic meaning still belongs to the command field, key, session, PCR, NV index or lifecycle check named by the TPM specification.
The result value 0x8028001E should remain attached to the symbolic name. Some this result logs store the value as a negative signed integer; others expose only a generic CNG, WMI, BitLocker or enrollment message. Neither substitution identifies the request header tag does not match a valid TPM 1.2 command form or its expected authorization-session count as precisely as it.
Collect a useful trace
- Producer for it: the TPM 1.2 command decoder and state machine.
- Rejected invariant: the request header tag does not match a valid TPM 1.2 command form or its expected authorization-session count.
- Decisive capture: the raw request header bytes, tag, paramSize, ordinal, expected auth areas, byte order, and the response header before any library translation.
- Safe comparison: decode the command buffer independently and compare its tag with the command variant actually serialized.
Narrow experiment
Build the result minimal case around the original command contract. Use a disposable object when the request can write NV data, advance a counter, change authorization state or consume a lock transition. The comparison is valid only when the caller, TPM generation and security policy remain the same.
| Question | Evidence for it |
|---|---|
| What exact state was rejected? | the request header tag does not match a valid TPM 1.2 command form or its expected authorization-session count |
| Which layer owns the result? | The TPM 1.2 command decoder and state machine. |
| What must be correlated? | the raw request header bytes, tag, paramSize, ordinal, expected auth areas, byte order, and the response header before any library translation |
| What is the controlled comparison? | decode the command buffer independently and compare its tag with the command variant actually serialized |
Similar-looking outcomes
| Constant | Checkpoint represented by its standard message |
|---|---|
TPM_E_IOERROR | An IO error occurred transmitting information to the TPM — a separate checkpoint when compared with this result. |
TPM_E_SHA_ERROR | The calculation is unable to proceed because the existing SHA-1 thread has already encountered an error — a separate checkpoint when compared with this result. |
TPM_E_ENCRYPT_ERROR | The encryption process had a problem — a separate checkpoint when compared with it. |
The codes above may appear in the same workflow, but they are not aliases. TPM_E_BAD_DATASIZE concerns a body or blob length after framing; it rejects the header form itself.
Operational response
Construct the header from the tpm structure definition and make the tag agree with the number and kind of authorization sessions. Do not clear ownership, delete keys or reset PCR-related state merely to see whether the message disappears; those actions can destroy the evidence and protected material while leaving serialization or command-order defects unchanged.
Proof for it consists of a successful replay plus validation of the intended key, PCR, NV, context, event-log, provider or service result. A software fallback or a newly provisioned blank TPM answers a different question than it.
Source material
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — Structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Commands — source for the checkpoint.
- Microsoft: TPM Base Services portal — source for the checkpoint.
Looking for a different code? Search another status or error code.