Fix NTE_SYS_ERR (0X80090021) BitLocker & TPM Error

When This Error Shows Up

You're logging into Windows 10 or 11, and suddenly BitLocker throws this error when you try to unlock a drive. Or maybe Windows Hello stops working, and you see "NTE_SYS_ERR (0X80090021) - A base error occurred" in the TPM management console. I've seen this happen most often after a Windows feature update (like going from 22H2 to 23H2) or after a BIOS update that resets TPM settings. Sometimes it just shows up after a crash or forced shutdown.

Root Cause – Plain English

The TPM chip inside your motherboard got scrambled. Think of it like a small computer that stores encryption keys. When the TPM's internal memory gets corrupted (bad update, power loss, or BIOS reset), it can't verify the keys needed for BitLocker or Windows Hello. The error code 0X80090021 means the TPM itself is in a bad state. You don't need a new motherboard. You just need to clear the TPM and start fresh.

Important: If you clear the TPM, you'll lose BitLocker keys stored there. That means you must have your BitLocker recovery key handy. If you don't have it, you'll lock yourself out of encrypted drives. Go grab it from your Microsoft account or wherever you backed it up before proceeding.

Step-by-Step Fix

I'm going to walk you through two methods. Method 1 is the safe one for most people. Method 2 is for when you can't even get into Windows.

Method 1: Clear TPM from Windows (if you can log in)

Press Windows key + R, type tpm.msc, and hit Enter. This opens the TPM Management on Local Computer window.
In the right panel under "Actions", click Clear TPM. You'll see a warning that clearing the TPM will reset it to factory defaults.
A dialog box pops up. Check the box that says "I have the TPM owner password" (even if you don't – it's just a confirmation). Then click OK.
Windows will ask you to restart. Restart now.
During reboot, you'll see a screen asking you to press a key (usually F12 or Delete) to confirm the TPM clear. Do it. Your PC will restart again automatically.
After logging back in, open tpm.msc again. You should see "The TPM is ready for use" in the Status field. If you see an error, restart once more.
Now open Command Prompt as admin. Type:
```
manage-bde -on C:
```
and press Enter. This re-enables BitLocker with a fresh TPM key. Enter your recovery key when asked.

Method 2: Clear TPM from BIOS/UEFI (if Windows won't boot)

Shut down your PC completely.
Turn it back on and press the key to enter BIOS/UEFI. Common keys: F2, Del, F10, Esc – depends on your motherboard. Look for a message like "Press F2 to enter Setup" during boot.
Inside BIOS, find the Security tab. Look for TPM, Trusted Computing, or Intel PTT/AMD fTPM. The exact name varies.
Select Clear TPM or Reset TPM. You might need to set a TPM owner password first (some BIOS require it). If asked, just type anything – you won't need it later.
Confirm the action. Your PC will restart. You might see a warning about TPM being cleared – that's normal.
Boot back into Windows. Open tpm.msc to verify the TPM is ready. Then run
```
manage-bde -on C:
```
in an admin command prompt to re-encrypt.

What to Check If It Still Fails

If the error comes back even after clearing the TPM, try these things:

Update your BIOS. Go to your motherboard or laptop manufacturer's site, download the latest BIOS, and flash it. Old BIOS versions sometimes have TPM bugs.
Check TPM firmware version. In tpm.msc, look under "TPM Manufacturer Information". Version 1.2 is ancient. Version 2.0 is what you need. If you see 1.2, your system is too old for modern BitLocker features.
Disable and re-enable TPM in BIOS. Set TPM to "Disabled", save and restart. Then go back in and enable it again. This forces a full reset.
Run System File Checker. Open Command Prompt as admin and type
```
sfc /scannow
```
. This fixes corrupted Windows files that might interfere with TPM.
Still broken? Your TPM chip might be physically failing. Check the Windows Event Viewer under System logs for TPM-related errors. If they keep appearing, you might need to replace your motherboard or get a USB TPM module if your board supports one.

One last thing: if you're using a Microsoft account, your BitLocker recovery key is at https://account.microsoft.com/devices/recoverykey. Save a copy to a USB drive. You don't want to be stuck without it.