| Previous | Next |
| TBS_E_NO_EVENT_LOG | TBS_E_PROVISIONING_NOT_ALLOWED |
TBS_E_ACCESS_DENIED
Technical interpretation
TBS_E_ACCESS_DENIED (0x80284012) belongs to the public and internal TPM Base Services path. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks Windows denied the caller permission to perform the selected TBS operation or command class.
The first producer to identify for it is the TBS client library, local RPC service and command scheduler before or around device execution. TBS centralizes TPM access through a local RPC service. A failure can therefore occur in the caller contract, RPC/service startup, scheduling, buffer handling or TPM submission, and each layer requires different evidence.
Inputs and state to capture
Preserve these this result items before changing anything:
- This result and
0x80284012, the exact returning method or command, and the first nested status. - caller token, integrity level, app-container state, command ordinal, TBS policy, process identity, and whether a higher-level API is available.
- The TPM generation, manufacturer/firmware revision, Windows build, caller identity and TBS/provider state for it.
- The complete opaque request artifacts, redacting authorization secrets but not rewriting structure boundaries.
Validate without broad changes
Run this focused check: run a harmless allowed TBS call under the same token and compare with the protected operation without elevating the whole application. Do not combine the result test with firmware updates, TPM clearing, account changes, key recreation and policy edits in the same trial; such a result cannot isolate this boundary.
| Checkpoint | Pass condition |
|---|---|
| Windows denied the caller permission to perform the selected TBS operation or command class | The original this result command reaches the next defined state without returning it. |
| Security behavior | The result verification still uses the intended TPM, authorization, locality and policy. |
| Output integrity | The object, digest, event log or state transition produced after it validates independently. |
Neighboring response codes
| Related result | Separate meaning |
|---|---|
TBSIMP_E_BUFFER_TOO_SMALL | The specified buffer was too small — a separate checkpoint when compared with it. |
TBS_E_BUFFER_TOO_LARGE | The input or output buffer is too large — a separate checkpoint when compared with it. |
TBSIMP_E_CLEANUP_FAILED | The context could not be cleaned up — a separate checkpoint when compared with it. |
The practical distinction is that TPM_E_COMMAND_BLOCKED is command-policy denial after TBS examines the command; it is the public access-control failure.
Fix and verify
The supported direction is to use the documented privilege boundary or a higher-level key API and grant only the minimum required access. Do not restart or disable TBS before capturing its service and event data. Most caller-contract errors are reproducible without touching TPM ownership, firmware state or stored keys.
If the same bytes still return it after the documented preconditions are satisfied, retain this code-specific trace for the platform vendor or Windows component owner rather than erasing state.
Technical references
- Microsoft: About TPM Base Services — source for the checkpoint.
- Microsoft: TBS return codes — source for the checkpoint.
- Microsoft: Tbsi_Context_Create — source for the checkpoint.
- Microsoft: Tbsip_Submit_Command — source for the checkpoint.
Looking for a different code? Search another status or error code.