| Previous | Next |
| TPM_E_COMMAND_BLOCKED | TPM_E_DUPLICATE_VHANDLE |
TPM_E_INVALID_HANDLE
Technical interpretation
TPM_E_INVALID_HANDLE (0x80280401) belongs to Windows command mediation around the TPM. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the Windows TBS translation layer cannot resolve the supplied virtual or physical handle for this command.
The first producer to identify for it is TBS command blocking, virtual-handle translation, retry or anti-hammering logic. Windows TBS schedules and mediates commands from multiple clients. It can block commands, translate virtual handles, request retry, and preserve anti-hammering policy before or after the raw device command path.
Read this result as its own boundary in a sequence, not as a verdict that every TPM feature is broken. The sequence reaches the Windows TBS translation layer cannot resolve the supplied virtual or physical handle for this command, and the component returns 0x80280401 before the application can safely assume that later key, attestation, boot or licensing work occurred.
Inputs and state to capture
- Request identity: exact function or command, input lengths, flags, caller context and this result.
- State identity: handle value, context handle, object type, creating response, TBS virtualization mapping, flush events, and process or power boundary.
- Platform identity for it: TPM generation, manufacturer/firmware revision, Windows build and relevant service events.
- Binary identity: preserve opaque structures byte-for-byte and log
0x80280401in hexadecimal.
Validate without broad changes
Create a fresh resource and use its returned virtual handle immediately within the same tbs context. Keep every other this result test condition unchanged. If the comparison reaches a later checkpoint, then the original the condition has been isolated even when a second defect remains.
| Observed outcome | Interpretation |
|---|---|
| The exact request succeeds | The changed condition belongs to the rejected the Windows TBS translation layer cannot resolve the supplied virtual or physical handle for this command. |
| A more specific earlier code appears | Preserve the earlier result in the result trace; the previous trace probably lost the first producer. |
| The same code returns with identical bytes | Escalate the persistent it with firmware, service and command evidence rather than broad configuration changes. |
| The code disappears only after destructive reset | The result experiment is not diagnostic because original protected state and evidence were removed. |
Neighboring response codes
| Nearby constant | Why it is different |
|---|---|
TPM_E_DUPLICATE_VHANDLE | The TPM returned a duplicate handle and the command needs to be resubmitted — a separate checkpoint when compared with it. |
TPM_E_COMMAND_BLOCKED | The command was blocked — a separate checkpoint when compared with it. |
TPM_E_EMBEDDED_COMMAND_BLOCKED | The command within the transport was blocked — a separate checkpoint when compared with it. |
For this page, the useful contrast is: TBS_E_INVALID_CONTEXT rejects the TBS context itself; this code concerns a resource handle inside a command.
Fix and verify
Apply the narrow remedy: stop reusing handles after close, flush, service restart or resume and keep them scoped to the creating context. Do not disable command policy globally to make one test pass. First establish the caller, command code and supported higher-level alternative, because command blocking is a security boundary.
Close the incident only when the same API or TPM command passes with the intended hardware-backed behavior and the expected output can be independently validated.
References
- Microsoft: Command Blocking in TBS — source for the checkpoint.
- Microsoft: Using TPM Base Services — source for the checkpoint.
- Microsoft: Tbsip_Submit_Command — source for the checkpoint.
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
Looking for a different code? Search another status or error code.