0X8028400D

TBS_E_COMMAND_CANCELED (0x8028400D) fix: why TPM commands fail

Windows Errors Intermediate 👁 8 views 📅 Jun 10, 2026

Windows throws this when the TPM driver bails on a command. Usually it's a driver conflict or TPM firmware glitch, not hardware failure.

1. Faulty TPM driver (most common cause)

What's actually happening here is the Windows TPM Base Services (TBS) driver receives a command from an app like BitLocker or Windows Hello, but the driver itself doesn't complete it. It returns 0x8028400D because the command was canceled internally — not by the user, but by the driver's own logic. This usually means the driver version mismatches the TPM firmware or the OS build.

I've seen this most often on Dell and Lenovo laptops after a Windows feature update, like moving from 22H2 to 23H2 on Windows 11. The motherboard TPM (usually a firmware TPM in the CPU) is fine, but the Windows driver stack hiccups.

Fix: Roll back or reinstall the TPM driver

  1. Open Device Manager (Win+X → Device Manager).
  2. Expand Security devices — you'll see Trusted Platform Module 2.0 listed there.
  3. Right-click it → Properties → Driver tab.
  4. If Roll Back Driver is clickable, do that first. Windows will revert to the previous driver that worked before the update.
  5. If rollback is greyed out, select Update driver → Browse my computer for drivers → Let me pick from a list. Choose the older driver version (often dated before the feature update).
  6. Reboot. Test with tpmtool getdeviceinformation in PowerShell — you should see status 0 (OK).

The reason step 5 works is Windows keeps a cache of previous drivers. Picking the older version forces TBS to use a known-stable driver. If that fails, go to your PC manufacturer's support page and download the chipset or TPM driver specifically for your model.

2. TPM firmware stuck in a bad state (second most common)

TPM firmware can get stuck mid-command if, say, a BitLocker key backup was interrupted or a power loss happened during a TPM provisioning event. The TPM itself isn't broken — its volatile state is corrupted. Clearing the TPM resets that state without modifying the permanent storage keys (like those used for BitLocker recovery).

But here's the catch: clearing the TPM will invalidate BitLocker, Windows Hello, and any app using TPM-based certificates. You'll need the BitLocker recovery key (check your Microsoft account or printout) before you do this.

Fix: Clear the TPM via Windows Security

  1. Open Windows Security → Device security → Security processor details.
  2. Click Security processor troubleshooting → Clear TPM.
  3. You'll be prompted to restart. After reboot, the TPM will reinitialize with a clean state.
  4. Re-enable BitLocker and re-register Windows Hello.

If the Windows UI won't cooperate (common on buggy builds), use PowerShell as admin:

Clear-Tpm

Then reboot. On some HP and Lenovo machines, you might need to enter the BIOS and reset TPM from there — look for a setting called TPM Device or Security Chip and set it to Available or Enabled.

3. BIOS/UEFI TPM setting is disabled or misconfigured (rare but happens)

Some OEMs hide the TPM toggle. If it's set to Disabled or Hidden, Windows can't talk to it at all. The error 0x8028400D then appears because TBS tries to send a command but the hardware layer rejects it before it even reaches the driver.

I've seen this specifically on ASUS motherboards where the fTPM setting was switched from Firmware TPM to Discrete TPM by a BIOS update, but no actual discrete TPM module was installed.

Fix: Enable TPM in BIOS

  1. Restart and press the BIOS key (F2 for Dell, F10 for HP, Del for ASUS, Esc for Lenovo).
  2. Look under Security or Advanced → Trusted Computing or TPM Configuration.
  3. Set TPM Device or Security Device Support to Enabled.
  4. Save and exit. On Intel CPUs, PTT (Platform Trust Technology) is the same thing — make sure it's on.

If the option is missing entirely, check if your CPU supports fTPM (most Intel 8th gen and later do). You may need a BIOS update to unhide the setting.

Quick-reference summary table

Cause Symptom Fix
Stale or mismatched TPM driver Error appears after Windows update Roll back or reinstall driver from Device Manager
Corrupted TPM volatile state Error on BitLocker or Hello setup Clear TPM via Windows Security or PowerShell
TPM disabled in BIOS Error on every TPM call, even after reboot Enable TPM or fTPM in UEFI settings

If none of these resolve it, run tpmtool getdeviceinformation and check the ManufacturerVersion — if it's 0.0.0.0, your TPM firmware itself might need a BIOS update. Head to the motherboard or laptop vendor's support site, download the latest BIOS, and flash it. That's the nuclear option, but it's killed this error on a dozen machines I've fixed.

Was this solution helpful?

TBS_E_COMMAND_CANCELED 0x8028400D TPM error Windows 11 TPM driver fix TPM command canceled TPM base services error BitLocker TPM error Windows security chip error TPM firmware update clear TPM Windows TBS error 0x8028400D TPM driver rollback Windows TPM troubleshooting