Fix TPM_E_BAD_LOCALITY (0x8028003D) on Windows 11/10

This TPM error means your system's locality setting is wrong for the operation. It typically happens after a sudden shutdown or BIOS update. Here's the fix.

Quick answer: This error means the TPM chip is stuck in a wrong security state (called a locality). The fix is to clear the TPM in BIOS, then reinitialize it in Windows. Don't mess with individual settings—just reset it.

Let me explain what's going on. The TPM (Trusted Platform Module) on your motherboard has different security zones called localities. Each locality is like a locked room—only certain processes can access that room. When you see TPM_E_BAD_LOCALITY (0x8028003D), it means a process tried to enter a room it's not supposed to be in. This usually happens after a hard shutdown, a power outage, or a failed BIOS update. The TPM gets confused about who's allowed where, and Windows throws this error whenever it tries to do anything security-related—like using BitLocker, Windows Hello, or playing a game that uses TPM-based anti-cheat.

I've seen this most commonly on Dell XPS and Lenovo ThinkPad laptops after a forced restart. But it can happen on any machine with a discrete TPM 2.0 chip. Don't worry—you won't lose your files. But you might have to re-enable BitLocker or re-register Windows Hello after the fix.

Fix Steps – Clear and Reinitialize the TPM

Restart your PC and enter BIOS/UEFI.
On most systems, you press F2, Del, or F10 during boot. For Surface devices, hold the Volume Up button. After pressing the key, you should see the BIOS menu within 10 seconds. If you don't, restart and try again—some PCs need you to spam the key.
Find the TPM settings.
Look for a section called Security, Trusted Computing, or TPM. On UEFI systems, it's often under Advanced. Don't change anything else—just locate the TPM options.
Clear the TPM.
Inside the TPM settings, look for an option like Clear TPM, Reset TPM, or Erase TPM. Select it and confirm. After you do this, you'll see a confirmation message like "TPM cleared successfully" or "TPM disabled until next boot."
Save changes and exit BIOS.
Press F10 (or select Save & Exit). Your PC will restart. Don't interrupt this boot—let it finish. You might see a message about TPM being reset. That's normal.
Boot into Windows and initialize the TPM.
Once Windows loads, open TPM Management. Press Win + R, type tpm.msc, and hit Enter. You should see a message saying "Compatible TPM cannot be found" or "TPM is off." That's because we cleared it. In the Actions panel on the right, click Prepare the TPM. Windows will reinitialize it. After a few seconds, you'll see the TPM status change to "The TPM is ready for use."
Reboot once more.
Restart your PC. After this, the error should be gone. Test it by trying whatever was failing before—like setting up Windows Hello or running a BitLocker check.

If the Main Fix Fails – Alternative Approaches

Sometimes the BIOS clear doesn't stick, or Windows doesn't detect the TPM afterward. Here's what to try next:

Update your BIOS. A buggy BIOS version can cause locality errors. Check your motherboard or laptop manufacturer's support site for the latest BIOS. Flash it using their tool. I've seen this fix stubborn TPM issues on ASUS and MSI boards.
Disable and re-enable the TPM in BIOS instead of just clearing it. Go back into BIOS, set TPM to Disabled, save and exit. Boot into Windows once (it'll complain), then go back into BIOS and set TPM to Enabled. This forces a full power cycle on the TPM chip.
Run the TPM diagnostics tool. Open PowerShell as Administrator and run Get-Tpm. If it says IsEnabled: False or IsActivated: False, you need to enable it via BIOS. If it says IsReady: False, run Initialize-Tpm (requires a reboot).
Check for a discrete TPM module. On some desktop PCs, the TPM is a separate chip plugged into a motherboard header. If it's loose or damaged, you might need to reseat it. Open your case, remove the TPM module, clean the contacts with a pencil eraser, and reinsert it securely.

Prevention Tips – Avoid This Error in the Future

This error almost always comes from an interrupted TPM operation. Here's how to stop it from happening again:

Never force shutdown your PC during a firmware update. If a BIOS, TPM firmware, or Windows update is running, let it finish—even if it takes 30 minutes. Pulling the plug or holding the power button corrupts the TPM state.
Keep your BIOS updated. Manufacturers fix TPM bugs in BIOS updates. Set a reminder to check for updates every 3-4 months. It takes 10 minutes and saves headaches.
Use a UPS if you're in an area with power flickers. A sudden power loss while the TPM is in the middle of a key generation can cause this locality lockup. A $50 UPS battery backup will prevent that.
Disable Fast Startup in Windows. Fast Startup can leave the TPM in a weird state if a hibernation file gets corrupted. Open Control Panel, go to Power Options, click "Choose what the power buttons do," then uncheck "Turn on fast startup." Reboot. This doesn't affect boot speed much on SSDs.

That's it. You should be error-free now. If you're still stuck after all these steps, you might have a failing TPM chip. In that case, contact your motherboard or laptop manufacturer—some TPM chips are soldered on and require a board replacement.