| Previous | Next |
| TPM_20_E_POLICY | TPM_20_E_PCR_CHANGED |
TPM_20_E_PCR
This is a live PCR-policy condition failure. The PCR selection, selected hash banks and current PCR values do not produce the digest required by the policy operation. It does not identify which boot component changed; it only establishes that the policy's expected measurement state is not the current TPM state.
Frequent causes
- The policy was built from another machine, another firmware or boot configuration, or a different PCR bank.
- The PCR selection changed in order, bank, index or bitmap even though the visible PCR values appear familiar.
- The intended state was captured correctly, but the machine has legitimately changed through firmware, bootloader, kernel, secure-boot or configuration updates.
Useful evidence
Collect the exact selection and current values with their hash algorithms, then compare them with the values used when the policy digest was constructed. Keep the policy command order and any OR or authorize steps, because a PCR check is often only one component of the complete policy. Avoid weakening a policy to bypass this response until the change in measurements is understood.
TCG: TPM2_PolicyPCR · tpm2_policypcr · tpm2_pcrread
Looking for a different code? Search another status or error code.