| Previous | Next |
| TBS_E_IOERROR | TBS_E_SERVICE_NOT_RUNNING |
TBS_E_INVALID_CONTEXT_PARAM
The state machine behind the code
TBS_E_INVALID_CONTEXT_PARAM (0x80284007) belongs to the public and internal TPM Base Services path. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the TBS context-creation structure contains a version, flags or TPM-generation request that the API does not accept.
The first producer to identify for it is the TBS client library, local RPC service and command scheduler before or around device execution. TBS centralizes TPM access through a local RPC service. A failure can therefore occur in the caller contract, RPC/service startup, scheduling, buffer handling or TPM submission, and each layer requires different evidence.
The result value 0x80284007 should remain attached to the symbolic name. Some this result logs store the value as a negative signed integer; others expose only a generic CNG, WMI, BitLocker or enrollment message. Neither substitution identifies the TBS context-creation structure contains a version, flags or TPM-generation request that the API does not accept as precisely as it.
Evidence table
- Producer for it: the TBS client library, local RPC service and command scheduler before or around device execution.
- Rejected invariant: the TBS context-creation structure contains a version, flags or TPM-generation request that the API does not accept.
- Decisive capture: structure version, includeTpm12/includeTpm20 flags, reserved fields, structure size, OS version, and the exact context-create entry point.
- Safe comparison: zero-initialize the documented structure and request only the detected TPM generation.
Reproduction plan
Build the result minimal case around the original command contract. Use a disposable object when the request can write NV data, advance a counter, change authorization state or consume a lock transition. The comparison is valid only when the caller, TPM generation and security policy remain the same.
| Question | Evidence for it |
|---|---|
| What exact state was rejected? | the TBS context-creation structure contains a version, flags or TPM-generation request that the API does not accept |
| Which layer owns the result? | The TBS client library, local RPC service and command scheduler before or around device execution. |
| What must be correlated? | structure version, includeTpm12/includeTpm20 flags, reserved fields, structure size, OS version, and the exact context-create entry point |
| What is the controlled comparison? | zero-initialize the documented structure and request only the detected TPM generation |
Contrast with neighboring results
| Constant | Checkpoint represented by its standard message |
|---|---|
TBS_E_SERVICE_START_PENDING | The TBS service has been started but is not yet running — a separate checkpoint when compared with this result. |
TBS_E_INSUFFICIENT_BUFFER | A specified output buffer is too small — a separate checkpoint when compared with this result. |
TBS_E_COMMAND_CANCELED | The command was canceled — a separate checkpoint when compared with it. |
The codes above may appear in the same workflow, but they are not aliases. TBS_E_BAD_PARAMETER covers parameters to TBS calls more generally.
Confirming remediation
Use the correct structure version and leave reserved fields zero; do not pass an application-private extension. Do not restart or disable TBS before capturing its service and event data. Most caller-contract errors are reproducible without touching TPM ownership, firmware state or stored keys.
Proof for it consists of a successful replay plus validation of the intended key, PCR, NV, context, event-log, provider or service result. A software fallback or a newly provisioned blank TPM answers a different question than it.
Source material
- Microsoft: About TPM Base Services — source for the checkpoint.
- Microsoft: TBS return codes — source for the checkpoint.
- Microsoft: Tbsi_Context_Create — source for the checkpoint.
- Microsoft: Tbsip_Submit_Command — source for the checkpoint.
Looking for a different code? Search another status or error code.