Fix TPM_E_BAD_MIGRATION (0X80280029) in Windows

TPM_E_BAD_MIGRATION happens when a TPM key's migration policy blocks export. Fix it by deleting and recreating the key, or clearing TPM as a last resort.

Quick answer

Delete the problematic TPM key (or clear the TPM) and recreate it. That's usually the fastest path because you can't change migration properties on an existing key.

What's actually happening here

TPM keys come with a migration policy that dictates whether the private portion of the key can be exported for backup or transfer. When an application tries to export or migrate a key whose policy doesn't allow it, Windows throws 0X80280029 (TPM_E_BAD_MIGRATION). This isn't a hard drive failure or a corrupted file—it's a security guard doing its job. The key was created with 'non-migratable' status, meaning the TPM will never let the private key leave the chip.

In my experience, this error shows up most often during BitLocker recovery, when you're trying to back up a TPM-protected key to a USB drive, or when a third-party encryption tool tries to duplicate a key. Sometimes it appears after a Windows update resets TPM-related policies. The error itself doesn't tell you which key is causing trouble, which makes it annoying to track down.

Numbered fix steps

Identify the affected app or service. Check Event Viewer (Windows Logs → System) for entries with source TPM or BitLocker around the time of the error. The event ID often points to the exact component trying to migrate the key.
Delete the offending key or container. If you know which service it is—for example, BitLocker—open an elevated Command Prompt and run:
```
manage-bde -protectors -delete C: -type TPM
```
This removes the TPM protector on the C: drive. Then re-add it with:
```
manage-bde -protectors -add C: -TPM
```
This forces the creation of a fresh key that Windows can manage. The new key will have the correct migration properties for the current OS version.
If the error persists, clear the TPM entirely. This is the nuclear option, but it works because it wipes all keys, including the one that's misbehaving. Go to tpm.msc, click 'Clear TPM', and restart. After reboot, Windows will re-initialize the TPM and create new keys. Note: This will break BitLocker if you're using a TPM-only protector—make sure you have your recovery key handy.
Recreate the affected service's keys. After clearing, if you use BitLocker, re-enable it:
```
manage-bde -on C:
```
Other tools like Windows Hello or Virtual Smart Card will automatically re-enroll on next login.

When the main fix fails

Sometimes the error won't go away even after clearing the TPM. That usually means a driver or firmware issue is messing with TPM commands. Here's what else to try:

Update your TPM firmware. Check your motherboard or laptop vendor's site. Lenovo and Dell released TPM firmware updates that fixed exactly this kind of migration bug. For example, the Dell TPM 2.0 firmware update v1.3.2.0 addressed migration policy errors on XPS 15 9560.
Run the TPM troubleshooter. In Windows 10/11, go to Settings → Update & Security → Troubleshoot → Additional troubleshooters → 'Hardware and Devices'. It won't magically fix everything, but it can reset the TPM driver state.
Check if a third-party security suite is interfering. Some EDR or antivirus tools hook into TPM functions and block migration calls. Temporarily disable the software and retry the migration.

Prevention tip

The root cause is almost always a key created by an older Windows version or a different TPM driver. When you upgrade Windows or change motherboard firmware, the migration policy on existing keys doesn't update. So before a major upgrade, back up your BitLocker recovery key and consider clearing the TPM once after the upgrade. It costs a reboot but saves you from hunting down 0X80280029 later.

Also, if you're a developer working with TPM APIs, always specify a migration policy when you create keys. Use TPM2_PolicyMigrate or set a duplicate policy if you ever need to export them. The default zero policy means non-migratable, and you'll hit this same error in your own code.