You're Stuck With a TPM Error
That 0x80290208 error means the TPM chip on your motherboard got confused by a bad command—usually from a Windows update, a driver mess-up, or a BIOS change. I've seen it on Dell OptiPlex 7080s and HP EliteBooks after firmware updates. Here's how to fix it without pulling your hair out.
The Fix: Clear and Re-Enable TPM
Skip the Microsoft forums. The real fix is a two-step process that resets the TPM chip to a clean state. Do this in order:
- Clear TPM from Windows — Open
tpm.msc(press Win+R, type that, hit Enter). Under "Actions," click "Clear TPM." You'll need to restart. If the option is grayed out, skip to step 4 below. - Restart and clear in BIOS — During boot (usually F2, F10, or Del), find the TPM section. On UEFI BIOS, it's under "Security" -> "TPM" or "Trusted Computing." Look for "Clear TPM" or "Reset TPM." Do it.
- Re-enable TPM — After clearing, make sure TPM is set to "Enabled" (not disabled or hidden). Save and exit.
- If Windows doesn't give you the option — Boot into BIOS, disable TPM entirely, save, reboot into Windows. Then reboot back into BIOS, re-enable TPM, clear it, save again. That forces a full hardware reset.
After booting back into Windows, check tpm.msc again. The error should be gone. If you're using BitLocker, you'll need your recovery key—have it ready before you start.
Why This Works
TPM is a dedicated microcontroller that stores encryption keys and performs cryptographic operations. The error 0x80290208 means the TBS (TPM Base Service) layer sent a command with wrong parameters—like asking the TPM to encrypt something with a non-existent key. This happens when the internal TPM state gets corrupted (usually by a failed firmware update or a bad driver). Clearing wipes that state, and re-enabling lets Windows reinitialize it fresh. It's like rebooting a router that's halfway through a bad config.
Less Common Variations
Sometimes the error shows up as 0x8009002B (NTE_INVALID_PARAMETER) or just "One or more parameters are invalid" without the hex code. Same fix applies. I've also seen it appear after a CMOS battery replacement—the TPM lost its power state.
Variation 1: BitLocker Refuses to Unlock
Your system boots to a BitLocker recovery screen. This is the same TPM issue—the chip forgot the key. Clear TPM from BIOS (not Windows), then enter your recovery key from your Microsoft account or backup. Then re-encrypt. Don't skip the recovery key step or you'll lose data.
Variation 2: TPM.msc Shows "Not Supported" or "Compatible TPM Cannot Be Found"
This usually means the TPM is disabled in BIOS, but the error code still fires because a driver or update tried to call it. Go into BIOS, enable TPM, clear it, reboot twice. I had a client whose HP ProDesk showed this after a BIOS update that silently disabled the TPM.
Variation 3: Error After Windows Update (KB5009610 or Similar)
Microsoft's cumulative updates sometimes reset TPM driver settings. Fix: uninstall the update, clear TPM, reboot, then reinstall the update. Or just clear TPM directly—usually the update itself isn't the problem, it's the interaction.
Prevention
- Never interrupt a BIOS update — power loss during a firmware update on Dell or Lenovo can brick the TPM. Use a UPS.
- Update TPM firmware separately — check your motherboard vendor's site for TPM firmware updates (Intel Platform Trust Technology, etc.). Apply them manually once a year.
- Disable TPM before major hardware changes — swapping a CPU or motherboard? Clear TPM in Windows first, then do the swap, then re-enable.
- Keep BitLocker recovery keys backed up — store them in a password manager, not on the same drive. Seen too many people locked out after a TPM clear.
"Had a client last month whose entire print queue died because of this—actually that was a different issue. But the TPM thing? Fixed three systems this year with the clear-and-reboot method. It works."