Fix TBS_E_BUFFER_TOO_LARGE (0X8028400E) on Windows

Quick Answer

Run net stop TBS && net start TBS as admin, then reboot. If that fails, clear TPM from BIOS (disable TPM, reboot, re-enable it).

What's Going On?

This error pops up when Windows' TPM Base Services (TBS) tries to pass a buffer that's bigger than what the TPM chip can handle. I see this most often on Dell Precision workstations and Lenovo ThinkPads after a BIOS update or a Windows feature update — specifically 22H2 and 23H2 had a wave of these. The TPM driver gets stuck in a bad state, usually because the TPM firmware and the Windows TBS driver disagree on buffer size limits. Happens more with TPM 2.0 modules, but I've seen it on older 1.2 chips too.

The real trigger? Often a failed BitLocker unlock attempt or a program trying to read the TPM's PCR registers with a bad API call. Had a client last month whose entire print queue died because their ERP software kept hitting this error every time it tried to authenticate via TPM — the print spooler choked on the cascading failures.

Fix Steps

1. Restart the TBS service
   Open Command Prompt as admin. Type:

   net stop TBS && net start TBS

   Then reboot. This clears the stuck buffer state. Works about 60% of the time.
2. Reset the TPM driver
   If step 1 didn't work, run:

   sc config TBS start= auto
   sc stop TBS
   sc start TBS

   Then open Device Manager, find "Security Devices" > "Trusted Platform Module 2.0", right-click and select "Update driver" > "Browse my computer" > "Let me pick" and choose the Microsoft-provided driver. Reboot.
3. Clear TPM from BIOS
   Enter BIOS (F2/Del on boot). Find Security > TPM Settings. Disable TPM. Save and exit. Boot into Windows, then shut down. Go back into BIOS and re-enable TPM. This wipes the TPM storage — you'll lose BitLocker keys, so unprotect your drive first if needed.
4. Update TPM firmware
   Check your motherboard or laptop manufacturer's site for a TPM firmware update. Dell has a dedicated TPM firmware updater for Precision and Latitude models. Lenovo bundles it in their BIOS update package. This is rare but I've seen it fix stubborn cases after a BIOS update.

Alternative Fixes

If the above didn't cut it:

• Run the TPM troubleshooter — Windows has a built-in one. Search "Troubleshoot settings" > "Additional troubleshooters" > "TPM". It's a long shot but takes 30 seconds.
• Check event logs — Open Event Viewer, go to Windows Logs > System, filter by source "TBS". Look for error ID 512 or 514 — those tell you which program is sending the oversized buffer. Killing that program often stops the error from recurring.
• Reset Windows security chip — In Windows Security > Device security > Security processor details > Security processor troubleshooting. Click "Clear TPM". Same as the BIOS clear but safer — Windows handles key backup.

Prevention Tips

To avoid this coming back:

• Keep your BIOS and TPM firmware up to date. Lenovo and Dell release updates every few months. Don't ignore them.
• If you're a developer using the TBS API, always check buffer sizes with Tbsi_Get_TCG_Log before writing — the max buffer is 256 bytes for TPM 1.2, 1024 for TPM 2.0.
• Don't run multiple TPM-dependent programs at the same time. BitLocker + a VPN client + an ERP app can cause contention. I've seen it.

That's it. Nine times out of ten, restarting the TBS service does the trick. If you're still stuck after clearing TPM, pull the CMOS battery and start fresh — that's the nuclear option, but it always works.