TPM 0X80280403: Blocked Command Fix

When You See This Error

You'll run into error code 0X80280403 (also shown as TPM_E_EMBEDDED_COMMAND_BLOCKED) when Windows tries to talk to your Trusted Platform Module (TPM) and the TPM says "nope, can't do that." It usually happens during BitLocker setup, when enabling secure boot, or after a BIOS update that messes with TPM settings. Had a client last month whose Dell laptop threw this after a Windows update—wouldn't let them turn on device encryption. Another guy had it on a custom PC after swapping the motherboard.

Root Cause

The TPM has a firmware-level lock on certain commands. It's a security feature—some commands get blocked if the TPM thinks they're risky. Common triggers: outdated TPM firmware, a bad BIOS setting, or a Windows update that changed how it talks to the TPM. The error means the TPM literally refused a command, not that Windows messed up. So you can't fix it by reinstalling Windows—that's a waste of time.

Fix It: Step by Step

These steps work for Windows 10 and 11 with TPM 2.0. Try them in order—don't skip.

Step 1: Clear the TPM

Clearing the TPM resets its internal state. It removes any keys stored there, so back up BitLocker recovery keys first. Here's how:

1. Press Win + R, type tpm.msc, hit Enter.
2. In the TPM Management window, find "Actions" on the right. Click "Clear TPM..."
3. Windows will ask you to restart. Do it. The TPM resets during boot.
4. After restart, check if the error's gone. If not, move to Step 2.

Step 2: Update TPM Firmware

Outdated TPM firmware is the #1 cause for this error. Go to your PC manufacturer's support site (Dell, HP, Lenovo, etc.) and grab the latest TPM firmware update. For custom builds, check your motherboard manufacturer's site (ASUS, Gigabyte, MSI). Install it, reboot, see if it fixed things.

Step 3: Check BIOS/UEFI TPM Settings

Sometimes the BIOS locks TPM commands too. Boot into your BIOS/UEFI (usually F2 or Del during startup). Look for TPM settings—often under "Security" or "Advanced." Make sure it's:

• TPM 2.0 (not 1.2)
• Enabled (not disabled)
• Not set to "Firmware TPM" if you have a dedicated TPM chip—use hardware TPM

Save and exit. Try the command that failed before.

Step 4: Update TPM Driver in Windows

Windows might be using a generic driver that doesn't play nice. Go to Device Manager (Win + X, choose Device Manager). Expand "Security devices." Right-click the TPM (likely "Trusted Platform Module 2.0"), choose "Update driver." Select "Browse my computer for drivers," then "Let me pick from a list." Pick the Microsoft driver (it's usually the right one). Restart.

If It Still Fails

Sometimes the TPM itself is toast. If none of the above works, you might have a hardware issue. On a laptop, check if the TPM chip is soldered or removable. I've seen a few machines where the TPM chip just died after a power surge. If it's removable, try reseating it. If not, you're looking at a motherboard replacement. Also, check Windows Event Viewer for related errors under "Applications and Services Logs > Microsoft > Windows > TPM-WMI." That can point to specific command codes that got blocked.

One more thing: on some Lenovo ThinkPads, there's a BIOS setting called "TPM Command Block" under Security > TPM. Turn that off. That's specific to Lenovo, but worth checking on other brands too—some manufacturers hide it in advanced menus.