| Previous | Next |
| TPM_E_DECRYPT_ERROR | TPM_E_NO_ENDORSEMENT |
TPM_E_INVALID_AUTHHANDLE
The decisive TPM checkpoint
TPM_E_INVALID_AUTHHANDLE (0x80280022) belongs to TPM 1.2 command processing. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks an authorization-session handle in a TPM 1.2 command does not identify a live session of the required kind.
The first producer to identify for this HRESULT is the TPM 1.2 command decoder and state machine. TPM 1.2 is a command/response device with strict binary structures and stateful resources. Windows may present the device response as an HRESULT, but the diagnostic meaning still belongs to the command field, key, session, PCR, NV index or lifecycle check named by the TPM specification.
Before changing the platform
Preserve these this result items before changing anything:
- This result and
0x80280022, the exact returning method or command, and the first nested status. - the auth handle returned by OIAP, OSAP or DSAP, the creating context, command sequence, continueAuthSession flag, and intervening flush or power event.
- The TPM generation, manufacturer/firmware revision, Windows build, caller identity and TBS/provider state for this HRESULT.
- The complete opaque request artifacts, redacting authorization secrets but not rewriting structure boundaries.
Test the contract
Run this focused check: create one fresh authorization session and use it exactly once with the failing command while logging handle substitution. Do not combine the result test with firmware updates, TPM clearing, account changes, key recreation and policy edits in the same trial; such a result cannot isolate this boundary.
| Checkpoint | Pass condition |
|---|---|
| an authorization-session handle in a TPM 1.2 command does not identify a live session of the required kind | The original this result command reaches the next defined state without returning it. |
| Security behavior | The result verification still uses the intended TPM, authorization, locality and policy. |
| Output integrity | The object, digest, event log or state transition produced after it validates independently. |
Why another code is not equivalent
| Related result | Separate meaning |
|---|---|
TPM_E_NO_ENDORSEMENT | The TPM does not have an Endorsement Key (EK) installed — a separate checkpoint when compared with it. |
TPM_E_DECRYPT_ERROR | The decryption process did not complete — a separate checkpoint when compared with it. |
TPM_E_INVALID_KEYUSAGE | The usage of a key is not allowed — a separate checkpoint when compared with it. |
The practical distinction is that TPM_E_BAD_HANDLE is a broader handle failure; it specifically points to an authorization handle.
Evidence of success
The supported direction is to stop caching stale session handles and recreate authorization state after context close, reset, resume, or a command that ended the session. Do not clear ownership, delete keys or reset PCR-related state merely to see whether the message disappears; those actions can destroy the evidence and protected material while leaving serialization or command-order defects unchanged.
If the same bytes still return it after the documented preconditions are satisfied, retain this code-specific trace for the platform vendor or Windows component owner rather than erasing state.
Technical references
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — Structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Commands — source for the checkpoint.
- Microsoft: TPM Base Services portal — source for the checkpoint.
Looking for a different code? Search another status or error code.