| Previous | Next |
| TPM_E_AUTH_CONFLICT | TPM_E_BAD_LOCALITY |
TPM_E_AREA_LOCKED
Which layer owns this HRESULT
TPM_E_AREA_LOCKED (0x8028003C) belongs to TPM 1.2 nonvolatile-storage policy. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the TPM 1.2 NV index is currently locked against the attempted write operation.
The first producer to identify for this HRESULT is the TPM 1.2 NV permission and lifecycle checks. TPM 1.2 NV indices combine permissions, authorization mode, locality masks and lock semantics. Two indices of the same size can behave differently because those attributes were fixed when each index was defined.
Diagnostic record
Preserve these this result items before changing anything:
- This result and
0x8028003C, the exact returning method or command, and the first nested status. - NV index attributes, writeDefine/writeSTClear/writeAll state, lock commands already issued, boot cycle, offset and write length.
- The TPM generation, manufacturer/firmware revision, Windows build, caller identity and TBS/provider state for this HRESULT.
- The complete opaque request artifacts, redacting authorization secrets but not rewriting structure boundaries.
How to verify the distinction
Run this focused check: query public index state and compare with a disposable unlocked index before any lock command is sent. Do not combine the result test with firmware updates, TPM clearing, account changes, key recreation and policy edits in the same trial; such a result cannot isolate this boundary.
| Checkpoint | Pass condition |
|---|---|
| the TPM 1.2 NV index is currently locked against the attempted write operation | The original this result command reaches the next defined state without returning it. |
| Security behavior | The result verification still uses the intended TPM, authorization, locality and policy. |
| Output integrity | The object, digest, event log or state transition produced after it validates independently. |
Common false equivalences
| Related result | Separate meaning |
|---|---|
TPM_E_BAD_LOCALITY | The locality is incorrect for the attempted operation — a separate checkpoint when compared with it. |
TPM_E_AUTH_CONFLICT | NV_LoadKey blob requires both owner and blob authorization — a separate checkpoint when compared with it. |
TPM_E_READ_ONLY | The NV area is read only and can't be written to — a separate checkpoint when compared with it. |
The practical distinction is that TPM_E_WRITE_LOCKED can mean the one-time write condition has already been consumed, while this code reports the area lock.
What a real fix looks like
The supported direction is to respect the lock lifetime or redefine a disposable index after the permitted lifecycle transition; a retry cannot unlock a permanent policy state. Do not undefine a production NV index until its public attributes and authorization policy have been recorded. NV policy is established at definition time, and destructive recreation can remove counters, certificates or provisioning state.
If the same bytes still return it after the documented preconditions are satisfied, retain this code-specific trace for the platform vendor or Windows component owner rather than erasing state.
Technical references
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — NV structures and permissions — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — NV commands — source for the checkpoint.
- Microsoft: Win32_Tpm class — source for the checkpoint.
Looking for a different code? Search another status or error code.