Fix TPM_E_AUTH_CONFLICT 0x8028003B

Quick answer (for the impatient)

Open tpm.msc, click "Clear TPM", restart, and let Windows reinitialize the TPM. This removes the conflicting authorization. If that fails, update your TPM firmware or chipset drivers.

What's happening here

You're seeing error 0X8028003B when the system tries to load a key into the TPM's NV storage (NV_LoadKey). The TPM is saying: "I have two different authorization requirements fighting each other — the owner auth and the blob auth." This usually happens after a Windows update, a BIOS change, or if you've tried to manage TPM keys manually with tools like tpm2-tools or third-party encryption software. The TPM gets confused about which auth policy to honor, and it locks up instead of loading the key. BitLocker users see this most often after a motherboard swap or firmware flash.

Fix steps (try in order)

Back up recovery keys first — if you use BitLocker, find your recovery key in your Microsoft account or print it from manage-bde -protectors -get C: in an admin command prompt. Without it, you'll lose access to encrypted drives.
Clear the TPM — press Win + R, type tpm.msc, hit Enter. In the console, look under "TPM Actions" on the right. Click "Clear TPM". You'll be prompted to restart. After the restart, the TPM resets to factory defaults — all keys, including the conflicting ones, are gone. Windows will re-create any needed keys on next boot. You'll see a "TPM initialized" message in system tray after login.
Check if the error persists — run Get-WmiObject -Namespace root/cimv2/security/microsofttpm -ClassName Win32_Tpm in PowerShell (as admin). If IsEnabled is True and no error shows, you're good. If you still see the conflict, move to the next step.
Update TPM firmware and drivers — go to your motherboard or laptop manufacturer's support page. Look for TPM firmware updates (often under BIOS/Utility). For Dell, it's in the "Security" category. For HP, it's under "System Software". Also update the TPM driver from Device Manager: expand "Security devices", right-click "Trusted Platform Module 2.0", choose "Update driver", then "Browse my computer", then "Let me pick", and select the latest. After install, reboot.
Clear TPM from BIOS — if the OS-level clear doesn't work, reboot into BIOS/UEFI (usually F2 or Delete during boot). Look for "TPM" or "Security" settings. There's usually an option to "Clear" or "Reset TPM". Do that, save, exit. Let Windows boot — it'll reinitialize the TPM.

Alternative fixes if main steps fail

Disable and re-enable TPM in BIOS — same path as above, but instead of clear, set TPM to "Disabled", save, reboot, go back in and set to "Enabled". This forces a fresh enumeration.
Use PowerShell to reset TPM owner auth — run Initialize-Tpm -AllowClear in an admin PowerShell window. This clears the TPM and sets a new owner authorization. Same result as the tpm.msc clear, but sometimes works when the GUI doesn't.
Update Windows to latest build — go to Settings > Update & Security > Windows Update, check for updates. Some TPM driver bugs got fixed in Windows 10 version 22H2 and Windows 11 version 23H2. Install all pending updates, including optional driver updates.

Prevention tip

Don't mix TPM management tools. If you're using BitLocker, don't also run tpm2-tools or third-party TPM utilities. They set conflicting authorization policies that can cause this error. Stick to one tool — Microsoft's built-in management. Also, before flashing your BIOS or swapping hardware, suspend BitLocker protection (manage-bde -protectors -disable C:) and clear the TPM if you plan to change the motherboard or CPU. That prevents auth conflicts from the start.