What does NTSTATUS 0xC0290018 (STATUS_TPM_WRONGPCRVAL) mean?

STATUS_TPM_WRONGPCRVAL

The current PCR state does not satisfy the TPM policy

STATUS_TPM_WRONGPCRVAL is a Windows NTSTATUS value mapped from the TPM facility. In this package the code belongs to TPM 1.2 style command processing, where Windows software, TBS, the TPM driver, and the hardware device all may be visible in the same failure path.

The relevant area is PCR-bound sealed storage and measured boot policy. This status is returned when a PCR-bound operation reaches a valid PCR policy, but the live PCR values are not the ones required by the object or command.

This is a state mismatch, not a malformed PCR-info structure. It often appears after firmware, bootloader, Secure Boot, kernel, driver, BitLocker, or policy changes that alter measured boot. The event log is needed to understand why the PCR value changed.

Diagnostic focus

• Read the relevant PCRs and compare them with the policy digest recorded in the object.
• Inspect the boot measurement event log to identify which component changed the PCR chain.
• Do not reseal data until you understand whether the changed PCR state is expected or indicates tampering.

References

• TCG: TPM 1.2 Part 1 Design Principles
• TCG: TPM 1.2 Part 2 Structures of the TPM
• TCG: TPM 1.2 Part 3 Commands
• Linux kernel: TPM Event Log
• UAPI Group: Linux TPM PCR Registry
• Microsoft: TPM fundamentals
• Microsoft: MS-ERREF NTSTATUS values