| Previous | Next |
| STATUS_TPM_INAPPROPRIATE_ENC | STATUS_TPM_INVALID_PCR_INFO |
STATUS_TPM_MIGRATEFAIL
The TPM rejected key migration authorization
STATUS_TPM_MIGRATEFAIL is a Windows NTSTATUS value mapped from the TPM facility. For STATUS_TPM_MIGRATEFAIL, in this package the code belongs to TPM 1.2 style command processing, where Windows software, TBS, the TPM driver, and the hardware device all may be visible in the same failure path.
The relevant area is migratable keys and migration authority checks. This status belongs to TPM key migration flows, where moving or rewrapping key material requires migration-specific authorization and policy checks.
A migration failure is different from failing to decrypt a blob. The TPM is rejecting the authority or policy conditions for migration, so diagnostics should include the key attributes, migration authority data, destination key, and command sequence used to authorize the move.
Diagnostic focus
- Record whether the key is migratable and which migration scheme is being used.
- Validate migration authority data and destination public-key identity before retrying.
- Check parent-key and owner authorization separately from migration authorization.
References for STATUS_TPM_MIGRATEFAIL
- TCG: TPM 1.2 Part 1 Design Principles
- TCG: TPM 1.2 Part 2 Structures of the TPM
- TCG: TPM 1.2 Part 3 Commands
- Microsoft: MS-ERREF NTSTATUS values
Looking for a different code? Search another status or error code.