| Previous | Next |
| TPM_E_BAD_MODE | TPM_E_BAD_VERSION |
TPM_E_BAD_PRESENCE
Classify the layer correctly
TPM_E_BAD_PRESENCE means the TPM 1.2 physical-presence state or lock bit conflicts with the requested protected operation.
Incident worksheet
| Question | Evidence |
|---|---|
| What exact state was rejected? | the TPM 1.2 physical-presence state or lock bit conflicts with the requested protected operation |
| Which layer owns the result? | The TPM 1.2 command decoder and state machine. |
| What must be correlated? | physicalPresence and physicalPresenceLock state, PPI request and response, firmware confirmation path, locality, and boot-cycle timing |
| Controlled comparison | inspect the supported PPI workflow and repeat the request through firmware confirmation rather than from an unattended runtime call |
A useful trace links three code-specific timelines: the application call, the local TBS/provider or firmware event, and the raw command/response exchange. The timestamps should describe one attempt; combining data from separate retries is particularly misleading for authorization sessions, context counters, DAA stages and lockout state.
A reproducible comparison
The one-variable check is to inspect the supported PPI workflow and repeat the request through firmware confirmation rather than from an unattended runtime call. Record the before/after state that the command is allowed to change. If the operation can have side effects, use a disposable key, session, counter or NV index rather than production material.
- Capture this result and
0x8028002Dat the first code-specific return boundary. - Decode the relevant state: raw command and response bytes, command ordinal, structure tags and the relevant TPM state.
- Run the controlled comparison once and preserve both binary transcripts.
- Verify the expected output or state transition instead of relying on absence of a UI message.
Related conditions often confused with this one
| Comparison code | Built-in distinction |
|---|---|
TPM_E_BAD_VERSION | The TPM cannot perform this version of the capability. |
TPM_E_BAD_MODE | A mode parameter is bad, such as capArea or subCapArea for TPM_GetCapability, phsicalPresence parameter for TPM_PhysicalPresence, or migrationType for TPM_CreateMigrationBlob. |
TPM_E_NO_WRAP_TRANSPORT | The TPM does not allow for wrapped transport sessions. |
It specifically answers whether the TPM 1.2 physical-presence state or lock bit conflicts with the requested protected operation. In contrast, TPM_E_BAD_LOCALITY concerns command locality, while it concerns physical-presence state and its lock.
Restore service safely
To remediate it, use the platform physical-presence interface and complete any required reboot or user confirmation; do not bypass the check in application code. Do not clear ownership, delete keys or reset PCR-related state merely to see whether the message disappears; those actions can destroy the evidence and protected material while leaving serialization or command-order defects unchanged.
Authoritative references
Looking for a different code? Search another status or error code.