| Previous | Next |
| TPM_E_EMBEDDED_COMMAND_BLOCKED | TPM_E_RETRY |
TPM_E_EMBEDDED_COMMAND_UNSUPPORTED
The relevant TPM condition
TPM_E_EMBEDDED_COMMAND_UNSUPPORTED means the command carried inside a legacy transport cannot be virtualized or supported by the Windows TBS transport path.
The first producer to identify is TBS command blocking, virtual-handle translation, retry or anti-hammering logic. Windows TBS schedules and mediates commands from multiple clients. It can block commands, translate virtual handles, request retry, and preserve anti-hammering policy before or after the raw device command path.
Before changing the platform
Preserve these items before changing anything:
- This result and
0x80280404, the exact returning method or command, and the first nested status. - outer and embedded ordinals, transport attributes, virtual handles used inside, TBS version, TPM version, and policy state.
- Record the TPM generation, manufacturer/firmware revision, Windows build, caller identity, and TBS/provider state.
- The complete opaque request artifacts, redacting authorization secrets but not rewriting structure boundaries.
Test the contract
Run this focused check: run the underlying command outside the transport with fresh handles to isolate transport-specific incompatibility. Do not combine the test with firmware updates, TPM clearing, account changes, key recreation and policy edits in the same trial; such a result cannot isolate this boundary.
| Stage | Pass condition |
|---|---|
| the command carried inside a legacy transport cannot be virtualized or supported by the Windows TBS transport path | The original command reaches the next defined state without returning it. |
| Security behavior | Verification still uses the intended TPM, authorization, locality and policy. |
| Output integrity | The object, digest, event log or state transition produced after it validates independently. |
Why another code is not equivalent
| Related result | Separate meaning |
|---|---|
TPM_E_RETRY | The TPM is too busy to respond to the command immediately, but the command could be resubmitted at a later time. |
TPM_E_EMBEDDED_COMMAND_BLOCKED | The command within the transport was blocked. |
TPM_E_DEFEND_LOCK_RUNNING | The TPM is defending against dictionary attacks and is in a time-out period. |
The practical distinction is that TPM_E_EMBEDDED_COMMAND_BLOCKED indicates policy denial; this code indicates unsupported transport semantics.
Evidence of success
The supported direction is to use a supported direct command path or a higher-level Windows key API rather than wrapping the operation. Do not disable command policy globally to make one test pass. First establish the caller, command code and supported higher-level alternative, because command blocking is a security boundary.
Technical references
- Microsoft: Command Blocking in TBS — source for this result.
- Microsoft: Using TPM Base Services — source for this result.
- Microsoft: Tbsip_Submit_Command — source for this result.
- TCG: TPM 1.2 Main Specification — source for this result.
Looking for a different code? Search another status or error code.