| Previous | Next |
| TPM_E_DAA_TPM_SETTINGS | TPM_E_DAA_ISSUER_VALIDITY |
TPM_E_DAA_STAGE
The decisive TPM checkpoint
TPM_E_DAA_STAGE (0x80280055) belongs to TPM 1.2 Direct Anonymous Attestation. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the next DAA command does not match the atomic stage expected by the TPM 1.2 DAA state machine.
The first producer to identify for this HRESULT is the staged DAA enrollment or signing state machine. Direct Anonymous Attestation in TPM 1.2 is a multi-stage protocol. Each stage consumes issuer data, TPM-specific state and outputs from earlier stages, so the first inconsistent transcript element is more useful than the final generic application failure.
The result value 0x80280055 should remain attached to the symbolic name. Some this result logs store the value as a negative signed integer; others expose only a generic CNG, WMI, BitLocker or enrollment message. Neither substitution identifies the next DAA command does not match the atomic stage expected by the TPM 1.2 DAA state machine as precisely as it.
Before changing the platform
- Producer for this HRESULT: the staged DAA enrollment or signing state machine.
- Rejected invariant: the next DAA command does not match the atomic stage expected by the TPM 1.2 DAA state machine.
- Decisive capture: submitted stage, TPM-reported or application-tracked stage, complete prior command order, session handle, and retry behavior.
- Safe comparison: restart a single DAA flow and log every stage transition without concurrent enrollment or signing work.
Test the contract
Build the result minimal case around the original command contract. Use a disposable object when the request can write NV data, advance a counter, change authorization state or consume a lock transition. The comparison is valid only when the caller, TPM generation and security policy remain the same.
| Question | Evidence for this HRESULT |
|---|---|
| What exact state was rejected? | the next DAA command does not match the atomic stage expected by the TPM 1.2 DAA state machine |
| Which layer owns the result? | The staged DAA enrollment or signing state machine. |
| What must be correlated? | submitted stage, TPM-reported or application-tracked stage, complete prior command order, session handle, and retry behavior |
| What is the controlled comparison? | restart a single DAA flow and log every stage transition without concurrent enrollment or signing work |
Why another code is not equivalent
| Constant | Checkpoint represented by its standard message |
|---|---|
TPM_E_DAA_ISSUER_VALIDITY | The issuer's validity check has detected an inconsistency — a separate checkpoint when compared with this result. |
TPM_E_DAA_TPM_SETTINGS | The consistency check on DAA_tpmSpecific has failed — a separate checkpoint when compared with this result. |
TPM_E_DAA_WRONG_W | The consistency check on w has failed — a separate checkpoint when compared with it. |
The codes above may appear in the same workflow, but they are not aliases. TPM_E_DAA_RESOURCES can occur at a valid stage when the TPM lacks room to execute it.
Evidence of success
Enforce the specified stage order and restart after a failed or lost stage instead of skipping ahead. Do not mix values from separate DAA attempts. The protocol is staged and transcript-bound; substituting one issuer value or nonce can make every later stage misleading.
Proof for this HRESULT consists of a successful replay plus validation of the intended key, PCR, NV, context, event-log, provider or service result. A software fallback or a newly provisioned blank TPM answers a different question than it.
Source material
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — DAA structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — DAA commands — source for the checkpoint.
- Microsoft: TPM technology overview — source for the checkpoint.
Looking for a different code? Search another status or error code.