| Previous | Next |
| TPM_E_INVALID_AUTHHANDLE | TPM_E_INVALID_KEYUSAGE |
TPM_E_NO_ENDORSEMENT
Classify the layer correctly
TPM_E_NO_ENDORSEMENT (0x80280023) belongs to TPM 1.2 command processing. This result means the operation requires a provisioned TPM 1.2 Endorsement Key but the TPM has no usable EK at that checkpoint.
Incident worksheet
| Question | Evidence |
|---|---|
| What exact state was rejected? | the operation requires a provisioned TPM 1.2 Endorsement Key but the TPM has no usable EK at that checkpoint |
| Which layer owns the result? | The TPM 1.2 command decoder and state machine. |
| What must be correlated? | EK presence and certificate information, ownership/provisioning state, manufacturer data, firmware events, and the exact command requiring endorsement hierarchy material |
| Controlled comparison | query EK capability through supported platform tooling and compare with a known-provisioned device of the same model |
A reproducible comparison
Use the following verification sequence:
- Capture the unmodified failing input and
0x80280023. - Query ek capability through supported platform tooling and compare with a known-provisioned device of the same model.
- Compare the first divergent field or state transition.
- Repeat the operation only after restoring the same baseline, with a bounded retry policy where the specification permits retry.
Related conditions often confused with this one
| Other code | Why a different remedy follows |
|---|---|
TPM_E_INVALID_KEYUSAGE | The usage of a key is not allowed. |
TPM_E_INVALID_AUTHHANDLE | An invalid handle was used. |
TPM_E_WRONG_ENTITYTYPE | The submitted entity type is not allowed. |
TPM_E_PERMANENTEK concerns an existing non-revocable EK, while this code reports that the required EK is absent. The difference determines whether to change serialization, authorization, resource lifetime, firmware/PPI state, command policy or only retry timing.
Restore service safely
Correct the original boundary by choosing this direction: repair platform provisioning through the OEM or supported Windows workflow; do not generate an arbitrary software key and label it an EK. Do not clear ownership, delete keys or reset PCR-related state merely to see whether the message disappears; those actions can destroy the evidence and protected material while leaving serialization or command-order defects unchanged.
Technical references
Looking for a different code? Search another status or error code.