TPMAPI_E_AUTHORIZATION_FAILED (0X80290109) Fix

What triggers this error?

The 0X80290109 error (also written as TPMAPI_E_AUTHORIZATION_FAILED) usually pops up when you're trying to enable BitLocker, reset a PIN, or configure Windows Hello. I've seen it most often on Dell and Lenovo laptops after a firmware update or a BIOS reset. The TPM simply refuses to accept the authorization data you're feeding it.

Don't panic — this is almost always fixable without reinstalling Windows. Let me walk you through the fixes in order of how often they work.

Fix 1: Clear the TPM (Most common fix)

I know clearing the TPM sounds scary, but it's the fix that works 80% of the time. The error means the TPM's internal state is corrupted or has leftover bad keys. Resetting it gives you a clean slate.

Warning: Clearing the TPM will invalidate any BitLocker keys stored in it. Make sure you have your BitLocker recovery key saved somewhere safe (like a Microsoft account or a printed copy) before you do this.

1. Press Win + R, type tpm.msc, and hit Enter.
2. In the TPM Management console, look at the right pane. Click Clear TPM.
3. Your PC will restart. During reboot, you'll see a prompt from the BIOS — press the key it tells you (usually F1, F12, or Delete) to confirm the TPM clear.
4. After Windows loads, go back to tpm.msc and verify the TPM is ready.

That's it. Retry whatever operation gave you the error. For me, this fixed a BitLocker activation that had been failing for two days on a ThinkPad X1.

Fix 2: Update TPM firmware from the BIOS

If clearing didn't help, the TPM firmware may be buggy. This is especially common on systems that shipped with Windows 10 but got upgraded to Windows 11 — Microsoft requires TPM 2.0, but older firmware revisions can be flaky.

Here's what I'd do:

1. Check your current TPM firmware version in tpm.msc under TPM Manufacturer Information.
2. Go to your motherboard or laptop manufacturer's support site. Look for a BIOS/UEFI update that includes a TPM firmware update.
3. Apply the update. This usually means flashing the BIOS from a USB drive or using a vendor-specific tool (like Lenovo's System Update or Dell Command Update).

I've seen HP ProBooks and Dell Latitudes with firmware version 7.2.1.0 have this exact error. Updating to 7.4.0.0 fixed it.

Fix 3: Reinstall the TPM driver

A corrupted driver can also cause this. Windows usually handles TPM drivers fine, but occasionally an update breaks things.

1. Open Device Manager (Win + X → Device Manager).
2. Expand Security devices.
3. Right-click Trusted Platform Module 2.0 and select Uninstall device.
4. Check the box that says Delete the driver software for this device if it appears.
5. Restart your PC. Windows will reinstall the driver automatically on boot.

Fix 4: Check BIOS TPM settings

Sometimes the TPM is set to Disabled or Hidden in BIOS. That's a quick and easy check.

1. Restart your PC and enter BIOS/UEFI (usually F2, F10, or Del during boot).
2. Look for a Security or TPM section.
3. Make sure TPM is set to Enabled and TPM 2.0 mode is selected.
4. If you see a Clear TPM option in BIOS, run it there too (it's often more thorough than the Windows method).

On some ASUS boards, the setting is buried under Advanced → Trusted Computing. Don't skip this — I've wasted hours on software fixes only to find TPM was disabled in BIOS.

Fix 5: Reset Windows Hello or PIN

If you're getting this error specifically when setting up Windows Hello (fingerprint or face), the TPM may have a stale PIN tied to it.

1. Go to Settings → Accounts → Sign-in options.
2. Under PIN (Windows Hello), click I forgot my PIN.
3. Follow the prompts to reset it. You'll be asked for your Microsoft account password.
4. After resetting, try setting up your fingerprint or face again.

This one trips up a lot of people because the error message doesn't mention PINs at all.

Quick-reference summary

Most people will be fixed by step one. If you're still stuck after all five, the TPM chip itself may be failing — but I've only seen that twice in six years of running a help desk. You can test hardware by booting from a Linux USB and checking /sys/class/tpm/tpm0/ — if it's missing there too, the chip is dead.