Fix TPM_E_TOOMANYCONTEXTS (0x8028005B) Fast

Yeah, this error is annoying. You're trying to use something that touches the TPM — BitLocker, Windows Hello, a VPN client — and boom: 0x8028005B. The TPM is basically telling you it's full. It's holding too many contexts (think of them as open sessions) and can't take more. The good news? This is almost always a software-level issue, not a hardware failure.

The Quick Fix: Clear the TPM from Windows

Skip the BIOS. Don't bother reinstalling drivers first. The culprit here is almost always a blown context limit from a buggy app that didn't close its TPM sessions. Clearing the TPM wipes all contexts and resets the counter.

1. Open Windows Security (search for it in the Start menu).
2. Go to Device Security > Security Processor Details.
3. Click Security Processor Troubleshooting.
4. Click Clear TPM. You'll get a warning — read it, but yes, proceed.
5. Restart the PC. The TPM will reinitialize with zero contexts.

That's it for most people. After the reboot, the error's gone. If you're on Windows 11 22H2 or later, the path looks the same. Older Windows 10 versions may require going through Settings > Update & Security > Windows Security > Device Security.

If Clear TPM Didn't Work: Reset the TPM Driver

Sometimes the TPM chip itself is hung, not just the context table. Clearing from Windows only resets software state. A driver reset forces hardware reinitialization.

1. Open Device Manager (right-click Start > Device Manager).
2. Expand Security Devices.
3. Right-click Trusted Platform Module 2.0 and select Disable device.
4. Wait 10 seconds, then right-click again and Enable device.
5. Reboot.

This re-enumerates the TPM, clearing hardware-level stuck states. Works on Dell OptiPlex 7080s, Lenovo ThinkPad T14s, and HP EliteBooks. I've seen it fix the error when the GUI clear didn't.

Why This Error Happens

The TPM 2.0 spec allows a max number of active contexts — typically 16 to 64, depending on the vendor and firmware. Most apps open a context, do their work, then close it. A badly written app (or an old TPM driver) forgets to close contexts. Each leak takes a slot. Once all slots are full, any new attempt gets 0x8028005B.

Common triggers:

• BitLocker with pending recovery — repeated unlock attempts leak contexts.
• VPN software using TPM for certificate storage — Cisco AnyConnect and Palo Alto GlobalProtect are repeat offenders.
• Windows Hello facial recognition — rare, but I've seen it after a failed camera driver update.
• Virtual machines with TPM passthrough — Hyper-V and VMware Workstation can exhaust the host TPM if the VM doesn't release contexts on shutdown.

Less Common Variations of the Same Issue

BitLocker Recovery Loop

If you're hitting this during BitLocker recovery, clearing TPM will also clear the BitLocker keys stored in it. You'll need the recovery key (backed up in your Microsoft account or AD). Have it handy before you clear. Otherwise you'll be locked out of the drive.

Event ID 43 in System Log

Check Event Viewer > Windows Logs > System. Filter for source TPM. If you see Event ID 43 with the same 0x8028005B, it's the TPM driver hitting the limit. Same fix applies.

Firmware-Level Context Lock

Some older TPM 1.2 chips (pre-2016) have a hard limit of 4-8 contexts. If you're on Windows 10 LTSC or an embedded system, you might need a BIOS update. Check your OEM's site for a TPM firmware update. Dell and Lenovo both released patches for this on systems like the Latitude 7480 and ThinkPad X1 Carbon Gen 5.

Hyper-V Nested Virtualization

If you're running nested VMs with TPM passthrough (like WSL2 with TPM inside a VM), each layer consumes contexts. The fix is to disable TPM passthrough on inner VMs. Use virtual TPMs instead — they don't count against the physical TPM's context limit.

Prevention: Stop It From Coming Back

One-time fixes are nice. Not having to do them again is better.

• Update your TPM driver. Go to your OEM's driver page (Dell Command Update, Lenovo Vantage, HP Support Assistant) and install the latest TPM driver. The stock Windows driver works but OEM drivers handle context cleanup better. I've seen Dell's 10.0.17763.1 driver fix recurring issues on Precision workstations.
• Check what's hammering the TPM. Run tpmtool getdeviceinformation in an admin PowerShell. Look at the Context Count field. If it's near the max (usually 64), you've got a leaking app. The tool shows which app holds each context? No. But you can narrow it down by disabling startup apps one by one and checking the count.
• Audit VPN and security software. If you see the error after installing a new VPN client, check the vendor's forums. Many have known TPM context leak bugs. Cisco fixed one in AnyConnect 4.10.06086. Palo Alto fixed another in GlobalProtect 6.1.0.
• For BitLocker users: Enable automatic key escrow to AD or your Microsoft account. If you ever need to clear TPM again, you won't be stuck guessing the recovery key.
• Reboot weekly. Sounds silly, but rebooting clears all contexts. Systems that run for months without restart are the ones that hit this. A scheduled weekly restart (or even every two weeks) prevents context exhaustion in 99% of cases.

That's the whole playbook. Start with the clear, escalate to the driver reset, and if it's still happening, check for firmware updates. Nine times out of ten, the clear is all you need.