Fix TPM_E_NOTRESETABLE (0X80280032) in Windows

Quick answer: Clear the TPM from Windows Security or your BIOS/UEFI settings. That resets all PCRs and usually kills the 0X80280032 error.

For the rest of you, here's the deal. TPM_E_NOTRESETABLE (0X80280032) shows up when some software—usually BitLocker or a secure boot process—tries to reset a Platform Configuration Register (PCR) that doesn't have the resettable attribute set. PCRs are basically hashes of your boot process. Some are meant to be reset during boot, others aren't. When Windows or a third-party app pokes one that's marked non-resettable, you get this error.

I've seen this most often on Dell and Lenovo machines running Windows 10 21H2 or later, especially after a BIOS update that flips Secure Boot settings. One client had it happen after they swapped a drive and tried to resume BitLocker encryption. The error itself is cryptic, but the fix is almost always the same: reset the entire TPM.

Fix Steps

1. Clear the TPM from Windows Security.
   Go to Windows Security > Device security > Security processor > Security processor details > Security processor troubleshooting and click Clear TPM. You'll need to reboot. This wipes all TPM keys, so BitLocker recovery keys or other TPM-based apps will need re-arming.
2. If Windows won't let you clear it, use the BIOS.
   Restart, hit F2 (Dell), F1 (Lenovo), or Del (most others) to enter setup. Look for Security or Trusted Computing settings. Find the option to Clear TPM or Reset TPM. Save and exit. Some systems need a confirmation at the next boot.
3. Use the tpm.msc tool as a fallback.
   Press Win+R, type tpm.msc, hit Enter. In the right pane, click Clear TPM. If it's grayed out, you're out of luck—stick with the BIOS route.

Alternative Fixes If Clearing Doesn't Work

Clearing the TPM fixes the error in 90% of cases. If it doesn't, you're dealing with something trickier.

• Check for BIOS updates. Some systems had a bug where the TPM firmware got into a weird state. A BIOS update from Dell or HP often includes a TPM firmware fix. Check your vendor's support site.
• Disable and re-enable the TPM. In BIOS, turn off the TPM device, boot once, then go back and turn it on. That occasionally clears stale state without a full clear.
• If BitLocker is the culprit, suspend it temporarily. Run Manage-bde -protectors -disable C: as an admin, reboot, then re-enable with Manage-bde -protectors -enable C:. This resets the PCR usage without clearing the TPM, which might be what you want if you're keeping keys.

Prevention Tips

Don't mess with PCRs manually unless you know exactly what you're doing. Third-party tools that modify Secure Boot or BitLocker can trigger this error if they try to reset a PCR that isn't resettable.

Also, always have a BitLocker recovery key saved to your Microsoft account or a USB drive before you clear the TPM. Trust me, you don't want to be staring at a BitLocker recovery screen at 2 AM.

If you're a sysadmin, standardize the TPM clear process in your imaging workflow. Every time you reimage a machine, clear the TPM first. It'll save you a ton of these errors down the road.