| Previous | Next |
| TPM_E_PPI_BLOCKED_IN_BIOS | TPM_E_PCP_DEVICE_NOT_READY |
TPM_E_PCP_ERROR_MASK
What failed and what did not
TPM_E_PCP_ERROR_MASK (0x80290400) belongs to Platform Crypto Provider error classification. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the bit mask used to identify Platform Crypto Provider TPM-related HRESULTs, not a failure returned for a key operation by itself.
The first producer to identify for it is CNG/NCrypt provider error mapping above TBS and the TPM. The Microsoft Platform Crypto Provider exposes TPM-backed keys through CNG. Provider HRESULTs may wrap key-policy, TBS or device failures, so the exact provider operation and nested status are essential.
The result value 0x80290400 should remain attached to the symbolic name. Some this result logs store the value as a negative signed integer; others expose only a generic CNG, WMI, BitLocker or enrollment message. Neither substitution identifies the bit mask used to identify Platform Crypto Provider TPM-related HRESULTs, not a failure returned for a key operation by itself as precisely as it.
Collect a useful trace
- Producer for it: CNG/NCrypt provider error mapping above TBS and the TPM.
- Rejected invariant: the bit mask used to identify Platform Crypto Provider TPM-related HRESULTs, not a failure returned for a key operation by itself.
- Decisive capture: the full HRESULT from NCrypt or certificate enrollment, provider name, operation, key property, nested TPM/TBS status, and hexadecimal representation.
- Safe comparison: classify a captured provider HRESULT with the mask, then decode the actual low-order PCP error rather than invoking a provider operation for the mask.
Narrow experiment
Build the result minimal case around the original command contract. Use a disposable object when the request can write NV data, advance a counter, change authorization state or consume a lock transition. The comparison is valid only when the caller, TPM generation and security policy remain the same.
| Question | Evidence for it |
|---|---|
| What exact state was rejected? | the bit mask used to identify Platform Crypto Provider TPM-related HRESULTs, not a failure returned for a key operation by itself |
| Which layer owns the result? | CNG/NCrypt provider error mapping above TBS and the TPM. |
| What must be correlated? | the full HRESULT from NCrypt or certificate enrollment, provider name, operation, key property, nested TPM/TBS status, and hexadecimal representation |
| What is the controlled comparison? | classify a captured provider HRESULT with the mask, then decode the actual low-order PCP error rather than invoking a provider operation for the mask |
Similar-looking outcomes
| Constant | Checkpoint represented by its standard message |
|---|---|
TPM_E_ERROR_MASK | This is an error mask to convert TPM hardware errors to win errors — a separate checkpoint when compared with this result. |
TPM_E_FAIL | The operation failed — a separate checkpoint when compared with this result. |
TPM_E_SHA_THREAD | There is no existing SHA-1 thread — a separate checkpoint when compared with it. |
The codes above may appear in the same workflow, but they are not aliases. TPM_E_ERROR_MASK classifies the broader TPM hardware mapping family, while this mask is tied to Platform Crypto Provider errors.
Operational response
Preserve provider and nested error values in telemetry and fix the concrete pcp condition. Do not treat a provider mask as a key-specific diagnosis. Preserve the exact NCrypt status and the inner TPM/TBS result before changing certificate or key enrollment policy.
Proof for it consists of a successful replay plus validation of the intended key, PCR, NV, context, event-log, provider or service result. A software fallback or a newly provisioned blank TPM answers a different question than it.
Source material
- Microsoft: How Windows uses the TPM — source for the checkpoint.
- Microsoft: CNG key storage providers — source for the checkpoint.
- Microsoft: NCryptOpenStorageProvider — source for the checkpoint.
- TCG: TPM 2.0 Library Specification — source for the checkpoint.
Looking for a different code? Search another status or error code.