| Previous | Next |
| STATUS_TPM_FAILEDSELFTEST | STATUS_TPM_BADTAG |
STATUS_TPM_AUTH2FAIL
The second TPM authorization check failed
STATUS_TPM_AUTH2FAIL is a Windows NTSTATUS value mapped from the TPM facility. In this package the code belongs to TPM 1.2 style command processing, where Windows software, TBS, the TPM driver, and the hardware device all may be visible in the same failure path.
The relevant area is two-authorization TPM commands. Some TPM commands authorize two different entities, such as two keys or an object plus owner authority. This status narrows the failure to the second authorization slot.
That distinction matters: the first secret may be correct, while the second entity secret, session nonce, or parameter digest is wrong. Logging only one authorization identity hides the real failure and can lead to changing the wrong key or owner secret.
Diagnostic focus
- Log both authorization entities and identify which one maps to the second authorization slot.
- Verify each session nonce and command parameter digest independently.
- Do not reset owner authorization when the failing slot belongs to a different key or entity.
References
- TCG: TPM 1.2 Part 1 Design Principles
- TCG: TPM 1.2 Part 2 Structures of the TPM
- TCG: TPM 1.2 Part 3 Commands
- Microsoft: TPM Base Services
- Microsoft: MS-ERREF NTSTATUS values
Looking for a different code? Search another status or error code.