| Previous | Next |
| TPM_20_E_NONCE | TPM_20_E_SCHEME |
TPM_20_E_PP
Physical presence is a platform authorization path
TPM_20_E_PP wraps TPM_RC_PP. It means the command is in the TPM's physical-presence command set and the platform did not assert the required authorization. This is different from a bad password or failed HMAC session: the TPM expects a firmware-controlled indication that an administrator is physically at the machine.
On PCs, the request is commonly staged by the operating system and completed during a restart in UEFI firmware. Clearing a TPM, changing selected platform controls, or approving a firmware-defined maintenance operation may therefore require an interactive preboot confirmation even when the Windows caller is an administrator.
What to verify
- Identify the exact TPM command rather than treating every authorization failure as an owner-password problem.
- Check whether a physical-presence request is pending and what reboot or shutdown transition the firmware requires.
- Confirm that the firmware implements the requested PPI operation; support varies by platform and operation number.
- Do not automate acceptance of a destructive clear operation without preserving recovery keys and understanding what TPM-bound secrets will be lost.
References
- TCG TPM 2.0 Library specification
- Microsoft: SetPhysicalPresenceRequest
- Microsoft: Win32_Tpm management interface
Looking for a different code? Search another status or error code.