| Previous | Next |
| TBS_E_ACCESS_DENIED | TBS_E_PPI_FUNCTION_UNSUPPORTED |
TBS_E_PROVISIONING_NOT_ALLOWED
Provisioning is a state machine with policy gates
TBS_E_PROVISIONING_NOT_ALLOWED indicates that Windows identified one or more actions needed to make the TPM ready, but the caller's provisioning flags did not authorize those actions. Examples include importing owner authorization, clearing an already-owned TPM, or scheduling a physical-presence prompt.
This is not a generic access-denied result. The provisioning API returns additional information describing required transitions such as reboot, shutdown, force clear, activation, or physical presence. Those bits should guide the next administrative step.
Safe handling
- Read the provisioning information bitmask instead of retrying with progressively broader flags.
- Back up BitLocker and other recovery material before permitting a force clear.
- Allow physical-presence prompts only when a local administrator can complete the firmware interaction.
- Respect enterprise TPM ownership and backup policy rather than reprovisioning a managed device ad hoc.
References
- Microsoft: Win32_Tpm Provision method
- Microsoft: TPM readiness information
- Microsoft: physical-presence requests
Looking for a different code? Search another status or error code.