| Previous | Next |
| TPM_E_BAD_TYPE | TPM_E_NOTFIPS |
TPM_E_INVALID_RESOURCE
Which layer owns this HRESULT
TPM_E_INVALID_RESOURCE (0x80280035) belongs to TPM 1.2 resources, delegation and contexts. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks a saved-context operation names one TPM resource type while the referenced handle or context contains another.
The first producer to identify for this HRESULT is the TPM resource, context or delegation manager, sometimes mediated by TBS virtualization. TBS can virtualize finite TPM resources, but a saved TPM context and a TBS virtual handle are not durable application IDs. Their validity depends on resource type, owning client context, TPM lifecycle and the exact save/load history.
The result value 0x80280035 should remain attached to the symbolic name. Some this result logs store the value as a negative signed integer; others expose only a generic CNG, WMI, BitLocker or enrollment message. Neither substitution identifies the a saved-context operation names one TPM resource type while the referenced handle or context contains another as precisely as it.
Diagnostic record
- Producer for this HRESULT: the TPM resource, context or delegation manager, sometimes mediated by TBS virtualization.
- Rejected invariant: a saved-context operation names one TPM resource type while the referenced handle or context contains another.
- Decisive capture: resourceType, handle, saved context header, creating command, TBS virtual-handle mapping, and whether the context came from another process or boot.
- Safe comparison: save and reload one fresh resource of the intended type within a single TBS context.
How to verify the distinction
Build the result minimal case around the original command contract. Use a disposable object when the request can write NV data, advance a counter, change authorization state or consume a lock transition. The comparison is valid only when the caller, TPM generation and security policy remain the same.
| Question | Evidence for this HRESULT |
|---|---|
| What exact state was rejected? | a saved-context operation names one TPM resource type while the referenced handle or context contains another |
| Which layer owns the result? | The TPM resource, context or delegation manager, sometimes mediated by TBS virtualization. |
| What must be correlated? | resourceType, handle, saved context header, creating command, TBS virtual-handle mapping, and whether the context came from another process or boot |
| What is the controlled comparison? | save and reload one fresh resource of the intended type within a single TBS context |
Common false equivalences
| Constant | Checkpoint represented by its standard message |
|---|---|
TPM_E_INVALID_STRUCTURE | The structure tag and version are invalid or inconsistent — a separate checkpoint when compared with this result. |
TPM_E_KEY_OWNER_CONTROL | The key is under control of the TPM Owner and can only be evicted by the TPM Owner — a separate checkpoint when compared with this result. |
TPM_E_BAD_COUNTER | The counter handle is incorrect — a separate checkpoint when compared with it. |
The codes above may appear in the same workflow, but they are not aliases. TPM_E_BADCONTEXT rejects an invalid context blob, while this code identifies a type mismatch for a context resource.
What a real fix looks like
Keep context blobs paired with their resource type and owning context; discard stale mappings after reboot or service restart. Do not persist volatile TPM or TBS handles as durable identifiers. A numeric handle can be valid only inside the creating context and lifecycle, even when its value looks unchanged after restart.
Proof for this HRESULT consists of a successful replay plus validation of the intended key, PCR, NV, context, event-log, provider or service result. A software fallback or a newly provisioned blank TPM answers a different question than it.
Source material
- Microsoft: Resource Virtualization in TBS — source for the checkpoint.
- Microsoft: Command Scheduling in TBS — source for the checkpoint.
- Microsoft: Using TPM Base Services — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Context commands — source for the checkpoint.
Looking for a different code? Search another status or error code.