What does HRESULT 0x80280059 (TPM_E_BAD_DELEGATE) mean?

TPM_E_BAD_DELEGATE

Interpret the condition first

TPM_E_BAD_DELEGATE (0x80280059) belongs to TPM 1.2 resources, delegation and contexts. This result means the TPM 1.2 delegation blob or row is invalid for the requested authorized operation.

Build the command transcript

Record the original command or API call before retry logic for this result mutates its nonces, handles, buffers or state. Also retain the full HRESULT as 0x80280059; signed decimal logging can obscure the TPM/TBS facility and make searches less precise.

Test one hypothesis

1. Establish the baseline with the same device, Windows build, account and TPM generation.
2. Perform one narrow experiment: decode and verify a newly issued delegation, then use it once for the intended command.
3. Compare raw inputs and the first response, not only the final application dialog.
4. Stop after the first changed result; if a later error replaces this HRESULT, this condition was passed even if the whole workflow still fails.

Do not merge these conditions

The key distinction is that TPM_E_DELEGATE_FAMILY identifies a family mismatch; this code covers the delegation object more generally.

A safe recovery path

To correct this, replace stale or corrupted delegation data and issue only the permissions required by the operation. Do not persist volatile TPM or TBS handles as durable identifiers. A numeric handle can be valid only inside the creating context and lifecycle, even when its value looks unchanged after restart.

Technical references

• Microsoft: Resource Virtualization in TBS.
• Microsoft: Command Scheduling in TBS.
• Microsoft: Using TPM Base Services.
• TCG: TPM 1.2 Part 3 — Context commands.