| Previous | Next |
| TPM_E_INVALID_RESOURCE | TPM_E_INVALID_FAMILY |
TPM_E_NOTFIPS
Locate the first producer
TPM_E_NOTFIPS (0x80280036) belongs to TPM 1.2 command processing. This result means the requested TPM 1.2 command is available only while the TPM is operating in the required FIPS mode.
The first producer to identify is the TPM 1.2 command decoder and state machine. TPM 1.2 is a command/response device with strict binary structures and stateful resources. Windows may present the device response as an HRESULT, but the diagnostic meaning still belongs to the command field, key, session, PCR, NV index or lifecycle check named by the TPM specification.
Read this result as its own boundary in a sequence, not as a verdict that every TPM feature is broken. The sequence reaches the requested TPM 1.2 command is available only while the TPM is operating in the required FIPS mode, and the component returns 0x80280036 before the application can safely assume that later key, attestation, boot or licensing work occurred.
Data to retain
- Request identity: exact function or command, input lengths, flags, caller context and this result.
- State identity: command ordinal, device FIPS capability and state, algorithm choices, firmware policy, and the application requirement that selected the command.
- Platform identity: TPM generation, manufacturer/firmware revision, Windows build and relevant service events.
- Binary identity: preserve opaque structures byte-for-byte and log
0x80280036in hexadecimal.
Verification sequence
Query the mode and run a functionally similar command that is valid in the current state without changing production policy.
| Observed outcome | Interpretation |
|---|---|
| The exact request succeeds | The changed condition belongs to the rejected the requested TPM 1.2 command is available only while the TPM is operating in the required FIPS mode. |
| A more specific earlier code appears | Preserve the earlier result in the diagnostic trace; the previous trace probably lost the first producer. |
| The same code returns with identical bytes | Escalate the persistent it with firmware, service and command evidence rather than broad configuration changes. |
| The code disappears only after destructive reset | The experiment is not diagnostic because original protected state and evidence were removed. |
Codes that answer different questions
| Nearby constant | Why it is different |
|---|---|
TPM_E_BAD_TYPE | Make identity blob not properly typed. |
TPM_E_NOTLOCAL | Attempt to reset a PCR register that requires locality and locality modifier not part of command transport. |
TPM_E_NOTRESETABLE | Attempt to reset a PCR register that does not have the resettable attribute. |
By contrast, TPM_E_BAD_SCHEME rejects a cryptographic scheme independent of whether the TPM is in FIPS mode.
Exit condition for the incident
Apply the narrow remedy: use a command valid for the active mode or provision a supported platform configuration through the vendor workflow. Do not clear ownership, delete keys or reset PCR-related state merely to see whether the message disappears; those actions can destroy the evidence and protected material while leaving serialization or command-order defects unchanged.
References
- TCG: TPM 1.2 Main Specification — source for this result.
- TCG: TPM 1.2 Part 2 — Structures — source for this result.
- TCG: TPM 1.2 Part 3 — Commands — source for this result.
- Microsoft: TPM Base Services portal — source for this result.
Looking for a different code? Search another status or error code.