| Previous | Next |
| TPM_E_EMBEDDED_COMMAND_BLOCKED | TPM_E_RETRY |
TPM_E_EMBEDDED_COMMAND_UNSUPPORTED
The decisive TPM checkpoint
TPM_E_EMBEDDED_COMMAND_UNSUPPORTED (0x80280404) belongs to Windows command mediation around the TPM. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the command carried inside a legacy transport cannot be virtualized or supported by the Windows TBS transport path.
The first producer to identify for it is TBS command blocking, virtual-handle translation, retry or anti-hammering logic. Windows TBS schedules and mediates commands from multiple clients. It can block commands, translate virtual handles, request retry, and preserve anti-hammering policy before or after the raw device command path.
Before changing the platform
Preserve these this result items before changing anything:
- This result and
0x80280404, the exact returning method or command, and the first nested status. - outer and embedded ordinals, transport attributes, virtual handles used inside, TBS version, TPM version, and policy state.
- The TPM generation, manufacturer/firmware revision, Windows build, caller identity and TBS/provider state for it.
- The complete opaque request artifacts, redacting authorization secrets but not rewriting structure boundaries.
Test the contract
Run this focused check: run the underlying command outside the transport with fresh handles to isolate transport-specific incompatibility. Do not combine the result test with firmware updates, TPM clearing, account changes, key recreation and policy edits in the same trial; such a result cannot isolate this boundary.
| Checkpoint | Pass condition |
|---|---|
| the command carried inside a legacy transport cannot be virtualized or supported by the Windows TBS transport path | The original this result command reaches the next defined state without returning it. |
| Security behavior | The result verification still uses the intended TPM, authorization, locality and policy. |
| Output integrity | The object, digest, event log or state transition produced after it validates independently. |
Why another code is not equivalent
| Related result | Separate meaning |
|---|---|
TPM_E_RETRY | The TPM is too busy to respond to the command immediately, but the command could be resubmitted at a later time — a separate checkpoint when compared with it. |
TPM_E_EMBEDDED_COMMAND_BLOCKED | The command within the transport was blocked — a separate checkpoint when compared with it. |
TPM_E_DEFEND_LOCK_RUNNING | The TPM is defending against dictionary attacks and is in a time-out period — a separate checkpoint when compared with it. |
The practical distinction is that TPM_E_EMBEDDED_COMMAND_BLOCKED indicates policy denial; this code indicates unsupported transport semantics.
Evidence of success
The supported direction is to use a supported direct command path or a higher-level Windows key API rather than wrapping the operation. Do not disable command policy globally to make one test pass. First establish the caller, command code and supported higher-level alternative, because command blocking is a security boundary.
If the same bytes still return it after the documented preconditions are satisfied, retain this code-specific trace for the platform vendor or Windows component owner rather than erasing state.
Technical references
- Microsoft: Command Blocking in TBS — source for the checkpoint.
- Microsoft: Using TPM Base Services — source for the checkpoint.
- Microsoft: Tbsip_Submit_Command — source for the checkpoint.
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
Looking for a different code? Search another status or error code.