Fix TPMAPI_E_INVALID_KEY_SIZE (0X8029010F)

This one's annoying

You're setting up BitLocker, or maybe a TPM-aware app like Windows Hello, and you hit TPMAPI_E_INVALID_KEY_SIZE (0X8029010F). The error text says exactly what you'd expect: the key size isn't valid. But what's actually happening here is that the TPM firmware or driver version changed, and the key you're trying to use was created under a different TPM state—different PCR banks, different algorithm support, or a different TPM spec entirely.

The fix: clear the TPM and re-create the key

Run this in an elevated PowerShell prompt:

Clear-Tpm

Then reboot. After the reboot, Windows will re-initialize the TPM. Now re-run whatever operation gave you the error—enabling BitLocker, provisioning Windows Hello, etc. That's it for 90% of cases.

If that doesn't work

You might have a stale key somewhere that needs manual deletion. Open the TPM MMC snap-in (tpm.msc) and look under "TPM Owner Authorization" — if there's an old key listed, right-click and delete it. Then run:

Initialize-Tpm

and reboot again.

When the above fails

Sometimes the issue is that your TPM is running in 1.2 compatibility mode but the OS expects 2.0. Check your BIOS/UEFI settings for "TPM Device Selection" or "TPM Firmware" — if you see an option for TPM 1.2 vs 2.0, make sure it's set to 2.0. Some older systems shipped with TPM 1.2 enabled by default, and Windows 11 really wants 2.0.

Why clearing the TPM fixes it

The TPM stores keys in its shielded memory, but each key is bound to the TPM's current state: the firmware version, the set of PCR registers, and the algorithm suite (RSA vs ECC, key sizes). When the TPM firmware changes—maybe through a BIOS update or a TPM firmware update pushed by Windows Update—the PCR values shift. A key created under the old PCR state won't match the new one. The error 0X8029010F is the TPM telling you: "I can't load this key because its size doesn't match what I expect for the current algorithm set."

Clearing the TPM deletes all stored keys. Then when you re-create the key (e.g., BitLocker provisioning), it's created with the current firmware's supported key sizes and PCR configuration. No mismatch, no error.

Less common variations

1. The key was created by a different OS version

If you dual-boot or migrated a Windows install from an older machine, the TPM key might have been created under Windows 10's TPM stack. Windows 11 uses a slightly different default key size (RSA 2048 vs RSA 1024). The fix is to clear the TPM and re-create the key from the current OS.

2. Third-party TPM management software

Some enterprise tools (e.g., Dell Data Protection, HP Client Security Manager) create their own TPM keys with custom key sizes. If you later disable or uninstall those tools, the keys orphan. Use the tool's own cleanup utility, or if you can't find one, clear the TPM and let Windows rebuild.

3. Hyper-V with vTPM

If you're running a VM with a virtual TPM and you migrate it to a host with a different physical TPM firmware version, the vTPM's key might not match. Shut down the VM, delete the vTPM device, then add a new one and boot. The guest OS will create fresh keys.

Prevention

Always clear the TPM before a major firmware update. If you know a BIOS update is coming, run Clear-Tpm first, apply the update, then let Windows re-initialize. That way you don't get stuck with orphaned keys.

If you use BitLocker, suspend protection before the firmware update (Manage-bde -protectors -disable C:), then re-enable after. This lets the TPM rebuild its key chain cleanly.

And if you're on Windows 10 and planning to upgrade to 11, clear the TPM before the upgrade. Saves a headache.

One more thing: Some UEFI settings lock the TPM after a firmware change. Check your BIOS for "TPM State" — it should be "Enabled" and not "Disabled" or "Hidden". A disabled TPM can't provision keys at all, which sometimes shows up as this same error code.

That's it. You're back to running. If you still see the error after all this, your TPM hardware might be failing — check the Event Viewer under Applications and Services Logs/Microsoft/Windows/TPM-Platform/Operational for more specific hardware errors.