| Previous | Next |
| TPM_E_NOTFIPS | TPM_E_NO_NV_PERMISSION |
TPM_E_INVALID_FAMILY
Locate the first producer
TPM_E_INVALID_FAMILY (0x80280037) belongs to TPM 1.2 nonvolatile-storage policy. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks a delegation command refers to a family identifier that is absent, stale or not valid for the requested TPM 1.2 operation.
The first producer to identify for this HRESULT is the TPM 1.2 NV permission and lifecycle checks. TPM 1.2 NV indices combine permissions, authorization mode, locality masks and lock semantics. Two indices of the same size can behave differently because those attributes were fixed when each index was defined.
Data to retain
| Question | Evidence for this HRESULT |
|---|---|
| What exact state was rejected? | a delegation command refers to a family identifier that is absent, stale or not valid for the requested TPM 1.2 operation |
| Which layer owns the result? | The TPM 1.2 NV permission and lifecycle checks. |
| What must be correlated? | family ID, family verification count, delegation row, owner state, command ordinal, and the context in which the family was created |
| What is the controlled comparison? | enumerate current delegation-family state and compare a freshly created test family rather than reusing a persisted numeric ID |
Separate caller data from platform state. The result caller data includes the command, structures, lengths, handles and flags; platform state includes TPM generation, provisioning, locality, lockout, resource inventory, firmware and the TBS service lifecycle. This result is actionable only after the rejected side is identified.
Verification sequence
Use the following verification sequence:
- Capture the unmodified failing input and
0x80280037. - Enumerate current delegation-family state and compare a freshly created test family rather than reusing a persisted numeric id.
- Compare the first result divergent field or state transition.
- Repeat this result only after restoring the same baseline, with a bounded retry policy where the specification permits retry.
Codes that answer different questions
| Other code | Why a different remedy follows |
|---|---|
TPM_E_NO_NV_PERMISSION | The permission to manipulate the NV storage is not available — a separate checkpoint when compared with this result. |
TPM_E_REQUIRES_SIGN | The operation requires a signed command — a separate checkpoint when compared with it. |
TPM_E_KEY_NOTSUPPORTED | Wrong operation to load an NV key — a separate checkpoint when compared with it. |
TPM_E_FAMILYCOUNT identifies a verification-count mismatch for an otherwise selected family. The result difference determines whether to change serialization, authorization, resource lifetime, firmware/PPI state, command policy or only retry timing.
Exit condition for the incident
Correct the original boundary by choosing this direction: refresh the family reference and rebuild dependent delegation blobs after family deletion, reset or ownership change. Do not undefine a production NV index until its public attributes and authorization policy have been recorded. NV policy is established at definition time, and destructive recreation can remove counters, certificates or provisioning state.
A successful it outcome preserves the intended hardware trust boundary, passes the original request, and produces verifiable output. Masking it, swallowing this HRESULT or switching silently to a software provider is not remediation.
References used for this checkpoint
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — NV structures and permissions — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — NV commands — source for the checkpoint.
- Microsoft: Win32_Tpm class — source for the checkpoint.
Looking for a different code? Search another status or error code.