| Previous | Next |
| TPM_E_BAD_MODE | TPM_E_BAD_VERSION |
TPM_E_BAD_PRESENCE
Classify the layer correctly
TPM_E_BAD_PRESENCE (0x8028002D) belongs to TPM 1.2 command processing. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the TPM 1.2 physical-presence state or lock bit conflicts with the requested protected operation.
Incident worksheet
| Question | Evidence for this HRESULT |
|---|---|
| What exact state was rejected? | the TPM 1.2 physical-presence state or lock bit conflicts with the requested protected operation |
| Which layer owns the result? | The TPM 1.2 command decoder and state machine. |
| What must be correlated? | physicalPresence and physicalPresenceLock state, PPI request and response, firmware confirmation path, locality, and boot-cycle timing |
| What is the controlled comparison? | inspect the supported PPI workflow and repeat the request through firmware confirmation rather than from an unattended runtime call |
A useful this result trace links three code-specific timelines: the application call, the local TBS/provider or firmware event, and the raw command/response exchange. The result timestamps should describe one attempt; combining data from separate retries is particularly misleading for authorization sessions, context counters, DAA stages and lockout state.
A reproducible comparison
The one-variable check is to inspect the supported PPI workflow and repeat the request through firmware confirmation rather than from an unattended runtime call. Record the before/after state that the result command is allowed to change. If the operation can have side effects, use a disposable key, session, counter or NV index rather than production material.
- Capture this result and
0x8028002Dat the first code-specific return boundary. - Decode the result state: raw command and response bytes, command ordinal, structure tags and the relevant TPM state.
- Run the result controlled comparison once and preserve both binary transcripts.
- Verify the expected this result output or state transition instead of relying on absence of a UI message.
Boundaries often confused with this one
| Comparison code | Built-in distinction |
|---|---|
TPM_E_BAD_VERSION | The TPM cannot perform this version of the capability — a separate checkpoint when compared with it. |
TPM_E_BAD_MODE | A mode parameter is bad, such as capArea or subCapArea for TPM_GetCapability, phsicalPresence parameter for TPM_PhysicalPresence, or migrationType for TPM_CreateMigrationBlob — a separate checkpoint when compared with it. |
TPM_E_NO_WRAP_TRANSPORT | The TPM does not allow for wrapped transport sessions — a separate checkpoint when compared with it. |
It specifically answers whether the TPM 1.2 physical-presence state or lock bit conflicts with the requested protected operation. In contrast, TPM_E_BAD_LOCALITY concerns command locality, while it concerns physical-presence state and its lock.
Restore service safely
To remediate it, use the platform physical-presence interface and complete any required reboot or user confirmation; do not bypass the check in application code. Do not clear ownership, delete keys or reset PCR-related state merely to see whether the message disappears; those actions can destroy the evidence and protected material while leaving serialization or command-order defects unchanged.
After correcting it, start with a fresh caller context where the protocol requires one, replay the original intended operation, and confirm that hardware-backed policy remains enforced.
Authoritative references
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — Structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Commands — source for the checkpoint.
- Microsoft: TPM Base Services portal — source for the checkpoint.
Looking for a different code? Search another status or error code.