0X80284003

TBS_E_INVALID_OUTPUT_POINTER (0x80284003) — Real Fix for Windows TPM Errors

EP
Erropedia Team
📅 September 27, 2026 📅 Updated Oct 21, 2026 👁 38 views Windows Errors Intermediate
A bad output pointer means a TPM command got a garbage address. The fix is almost always a TPM clear plus a firmware flag reset, not a reinstall.

You opened tpm.msc, clicked Prepare the TPM, and got slapped with TBS_E_INVALID_OUTPUT_POINTER (0x80284003) — annoying, I know. Let's fix it.

The real fix: clear the TPM and reset the firmware flag

Ninety percent of 0x80284003 cases come from the TPM being in a half-initialized state. The operating system sends a command, the TPM firmware returns a pointer that no longer points to valid memory, and the Trusted Platform Module Base Service (TBS) rejects it. Clearing the TPM wipes that stale state. Here's how to do it safely.

Back up your BitLocker recovery key first. If your drive is encrypted, clearing the TPM without the recovery key means you lose the drive. Open manage-bde -protectors -get C: in an admin Command Prompt and save the 48-digit key somewhere that isn't on the machine.

Step 1 — Suspend BitLocker (if it's on)

  1. Right-click Start, pick Terminal (Admin) or PowerShell (Admin).
  2. Run: 
    manage-bde -protectors -disable C: -rebootcount 2
  3. You should see "The operation completed successfully." If you see "Access denied," you're not elevated — close the window and reopen as admin.

Step 2 — Clear the TPM from Windows

  1. Press Win + R, type tpm.msc, hit Enter. The TPM management snap-in opens.
  2. In the right pane, click Clear TPM.
  3. A dialog warns that data will be lost. Tick the box, then click Restart. The machine reboots and the firmware prompts you to confirm the clear.
  4. On most Dell, HP, and Lenovo business laptops, the confirm prompt is a physical keypress — F1 on Dell, F1 or Enter on HP, and F12 on some Lenovo ThinkPads. Watch the screen carefully; the prompt sits for about 10 seconds.

After the reboot, open tpm.msc again. You should see Status: The TPM is ready for use and Specification Version: 2.0. If it still says "Cannot find the compatible TPM" or throws 0x80284003, keep going.

Step 3 — Clear the TPM from the firmware (when Windows balks)

  1. Reboot and tap the BIOS key — F2 on most Dells, F10 on HP, F1 or Enter on Lenovo.
  2. Find the Security or Trusted Computing menu.
  3. Look for TPM State, TPM Device, or Security Device Support. Set it to Enabled or Available.
  4. Look for a Clear TPM or Reset TPM entry. Run it.
  5. Save and exit (F10 usually). The machine powers down.

Step 4 — Re-enable BitLocker and verify

  1. Boot Windows. Wait 60 seconds for the TPM service to settle.
  2. Run: 
    manage-bde -protectors -enable C:
  3. Check the status: 
    manage-bde -status C:
    Look for Protection On.
  4. If you were using Windows Hello, you'll need to re-enroll your PIN — the TPM clear invalidated the old one. Settings → Accounts → Sign-in options → PIN → I forgot my PIN.

Why this works

The TPM stores its state in non-volatile memory. That memory can end up with a stale pointer after certain events — a botched firmware update, an interrupted BitLocker provisioning, or a forced power-off during boot. When TBS sends a command like Tpm2_GetCapability, the firmware returns an address in that corroded region, and TBS returns STATUS_INVALID_PARAMETER, which maps to 0x80284003.

Clearing the TPM zeroes those NVRAM areas and re-runs the self-test. The TPM comes back with a fresh endorsement key chain and valid pointers. Re-enabling BitLocker re-seals the volume master key against the new TPM state, so encryption keeps working without you touching recovery keys.

The firmware clear is the belt to Windows' suspenders. Some boards — especially Supermicro workstations and older ASRock consumer boards — hide a "TPM 2.0 device" toggle that leaves the TPM in a partial state when Windows tries to talk to it. Toggling it at the firmware level forces a full re-init cycle.

Less common variations of the same error

TPM is disabled in firmware but Windows still sees it

You'll hit 0x80284003 when Windows tries to talk to a TPM that the firmware has marked "not present." Check Device Manager under Security devices. If it shows a yellow bang, right-click, uninstall, and scan for hardware changes. If the entry doesn't come back, the firmware flag is off — go back to Step 3.

Stale TPM driver from an in-place upgrade

Windows 10 21H2 to Windows 11 in-place upgrades sometimes leave the old TPM 1.2 driver bound. Open Device Manager, expand Security devices, right-click the TPM entry, Update driver, Browse my computer, Let me pick from a list. Choose Trusted Platform Module 2.0 (Microsoft), not the vendor stub. Reboot.

Interrupted BitLocker provisioning

If someone yanked the power during the initial BitLocker encryption, the TPM holds a partial key blob and 0x80284003 pops up every time you touch tpm.msc. Run these in order, elevated:

manage-bde -off C:
manage-bde -status C:

Wait for the decrypt to finish (can take an hour on a big drive), then clear the TPM and re-enable BitLocker from scratch.

Virtual TPM in Hyper-V or VMware

Nested VMs that pass through a vTPM can throw 0x80284003 if the host's TPM state is corrupt. On Hyper-V, shut the VM down, disable the TPM in VM settings, apply, re-enable it, then boot. On VMware Workstation 17, remove the vTPM device from the VMX, power on, power off, and add a fresh one.

Firmware bug on Intel 11th-gen platforms

Certain Intel 500-series boards shipped with a microcode bug that broke the TPM's locality-2 communication. The TPM would return a valid pointer the first call and a garbage one the second. Check your motherboard vendor for a BIOS release from late 2021 or later and flash it. This is the one case where clearing the TPM won't help — the bug is in the firmware, not the TPM state.

Prevention

  • Flash BIOS through the vendor's official utility, never from a USB stick you built by hand. Corrupt firmware updates are the number one cause of hardware-level TPM corruption.
  • Don't force-power-off during boot. The TPM's NVRAM is written to during early boot, and cutting power mid-write is how you end up with a bad pointer in the first place.
  • Keep the TPM firmware current. Dell, HP, and Lenovo push TPM firmware updates through Windows Update and their own utilities. Run them quarterly.
  • Save your BitLocker recovery key to Entra ID or Active Directory, not just a text file. If the TPM dies outright, the key is your only way back into the drive.
  • Don't toggle Secure Boot or TPM settings just to "see what happens." Every toggle forces a re-seal of the BitLocker key, and a crash in the middle is a guaranteed 0x80284003.

If you've cleared the TPM twice and the error still comes back on the same hardware, the TPM chip itself is bad. On most business laptops it's a separate module you can swap (Dell part numbers usually start with 0). On consumer boards it's soldered — plan on a motherboard replacement or a firmware-level workaround, and disable BitLocker's TPM binding in favor of a startup PIN.

Related Errors in Windows Errors
0X8011042B COMADMIN_E_NOTDELETEABLE (0X8011042B) Delete Disabled Fix 0X000003F8 Registry I/O Fail 0x3F8: Dead Drive or Corrupt Hive? 0XC00D0044 Fix NS_E_INVALID_TTL (0XC00D0044) on Windows Media Services 0X800F020B SPAPI_E_NO_SUCH_DEVINST (0x800F020B): Device Instance Missing
TBS_E_INVALID_OUTPUT_POINTER 0x80284003 TPM error Windows 10 TPM error Windows 11 tpm.msc error clear TPM fix TPM firmware update BitLocker TPM error device guard TPM Windows Hello TPM TPM 2.0 error tbs error trusted platform module fix TPM ready status PCR banks TPM

Was this solution helpful?

EP
Erropedia Team
Tech Support Editors
The Erropedia editorial team researches and documents real-world tech errors from across Windows, Linux, macOS, networking, databases, cloud platforms, and more. Every solution is reviewed for accuracy and updated as software and systems evolve.