| Previous | Next |
| TPM_E_BAD_KEY_PROPERTY | TPM_E_BAD_SCHEME |
TPM_E_BAD_MIGRATION
Technical interpretation
TPM_E_BAD_MIGRATION (0x80280029) belongs to TPM 1.2 key migration and endorsement policy. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the key migration attributes or migration authorization do not form a permitted TPM 1.2 migration policy.
The first producer to identify for this HRESULT is the certified-migration, key-policy or EK administrative checkpoint. TPM 1.2 migration policy is encoded when a key is created and reinforced by signed authority tickets and source/destination bindings. Migration errors therefore require the original binary artifacts and key attributes, not only the user-visible key name.
Inputs and state to capture
Preserve these this result items before changing anything:
- This result and
0x80280029, the exact returning method or command, and the first nested status. - migratable and migration-authority flags, key type, parent, migrationAuth, destination data, and the command used to create the migration blob.
- The TPM generation, manufacturer/firmware revision, Windows build, caller identity and TBS/provider state for this HRESULT.
- The complete opaque request artifacts, redacting authorization secrets but not rewriting structure boundaries.
Validate without broad changes
Run this focused check: repeat with a disposable key created explicitly for the intended migration model and a freshly generated authorization value. Do not combine the result test with firmware updates, TPM clearing, account changes, key recreation and policy edits in the same trial; such a result cannot isolate this boundary.
| Checkpoint | Pass condition |
|---|---|
| the key migration attributes or migration authorization do not form a permitted TPM 1.2 migration policy | The original this result command reaches the next defined state without returning it. |
| Security behavior | The result verification still uses the intended TPM, authorization, locality and policy. |
| Output integrity | The object, digest, event log or state transition produced after it validates independently. |
Neighboring response codes
| Related result | Separate meaning |
|---|---|
TPM_E_MA_TICKET_SIGNATURE | Migration authority signature validation failure — a separate checkpoint when compared with it. |
TPM_E_MA_DESTINATION | Migration destination not authenticated — a separate checkpoint when compared with it. |
TPM_E_MA_SOURCE | Migration source incorrect — a separate checkpoint when compared with it. |
The practical distinction is that TPM_E_MA_AUTHORITY and related MA codes diagnose certified-migration participants, while this code rejects the key migration properties.
Fix and verify
The supported direction is to recreate the key or migration workflow with consistent migration attributes; nonmigratable key policy cannot be reversed after creation. Do not edit a signed ticket, migration blob or opaque private-key structure. Binary normalization, JSON conversion or base64 line handling can invalidate the authority and integrity relationships.
If the same bytes still return it after the documented preconditions are satisfied, retain this code-specific trace for the platform vendor or Windows component owner rather than erasing state.
Technical references
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — Certified migration structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Migration commands — source for the checkpoint.
- Microsoft: How Windows uses the TPM — source for the checkpoint.
Looking for a different code? Search another status or error code.