You hit 0X80290100 at the worst possible moment. Maybe you're enabling BitLocker on a fresh Lenovo ThinkPad and Windows throws "The command buffer is not in the correct state" right when the pre-provisioning step kicks off. Or Windows Hello setup stalls during PIN creation and lands you here. Dell OptiPlex machines on the 1.2.x TPM firmware are notorious for it too. Whatever triggered it, 0X80290100 essentially means Windows walked up to the TPM, sent a command, and the TPM said "I'm not ready for that."
What's actually happening
The TPM is a state machine. It has an ownership state, an initialization state, a session state, and a bunch of internal slots that need to be in specific conditions before certain commands get accepted. When Windows (or a third-party tool) fires a command while the TPM is mid-transition — say, right after a firmware flash, or while another process still holds a session open — the TPM rejects it with TPMAPI_E_INVALID_STATE.
Common triggers I've seen on real tickets:
- TPM firmware was just updated but the machine hasn't been fully power-cycled (cold boot, not restart)
- A third-party security agent or MDM client is holding a TPM session open — CrowdStrike Falcon and some older Symantec Endpoint builds have done this
- BitLocker pre-provisioning runs before the TPM finished its own self-test after a BIOS update
- You tried to Clear-Tpm while a key protector was still active
- The TPM is disabled in BIOS/UEFI and Windows is poking at a phantom device
So it's not usually corruption. It's timing and ownership. That's why rebooting sometimes "fixes" it and why it comes back later.
The fix — do these in order
1. Cold boot, not restart
Shut down fully. Pull power for 30 seconds on a desktop, or hold Shift while clicking Shut down on a laptop to bypass Fast Startup. Fast Startup keeps the TPM in whatever half-state it was in. A real cold boot resets the TPM's volatile state.
2. Confirm the TPM is enabled and owned correctly
Press Win+R, type tpm.msc, hit Enter. You want to see "The TPM is ready for use" and the spec version (2.0 on anything modern). If it says "The TPM is not present" or shows 1.2 when you expected 2.0, jump into BIOS/UEFI and check the firmware TPM setting — on Intel boards it's usually labeled PTT (Platform Trust Technology), on AMD it's fTPM. Toggle it off, save, reboot, toggle it back on, save, reboot. That forces a re-enumeration.
3. Check for a firmware update
Vendor TPM firmware has had real bugs around this error. Dell shipped a TPM 2.0 firmware update (targeting versions below 7.2.1.0) specifically to address command-buffer state issues on Latitude and OptiPlex. HP has similar fixes. Grab the TPM firmware updater from your OEM's support page — not from Windows Update — and run it. Cold boot after.
4. Clear the TPM the right way
Only do this if you're not currently using BitLocker, or you have your recovery key saved somewhere you can actually find it. Clearing the TPM without the key turns your encrypted drive into a brick.
From an elevated PowerShell:
# Back up your BitLocker recovery key first if BitLocker is on
Get-Tpm
Clear-Tpm -Force
Restart-Computer -ForceIf Clear-Tpm itself fails with 0X80290100, that's your confirmation the TPM is stuck in an unresponsive state. Pull power completely for 60 seconds, boot back into Windows, and try again. If it still fails, use the BIOS-level "Clear TPM" option on the next boot (usually under Security → TPM on Dell, Security → TPM Embedded Security on HP).
5. Kill the competing session
If you've got an EDR agent, MDM client, or a TPM-aware app (some password managers, some VPN clients) running, temporarily disable it and retry. You can also check whether something is actively holding a TPM handle in Resource Monitor — but honestly, the fast path is: boot into Safe Mode with networking, retry the operation, see if it works. If it does, you've found your culprit.
6. Re-initialize
After a successful clear, run:
Initialize-Tpm -AllowClear -AllowPhysicalPresenceWindows will take ownership and re-provision. Then re-run whatever you were doing (BitLocker enable, Hello setup, whatever).
If it still fails
Check the event log first — Event Viewer → Applications and Services Logs → Microsoft → Windows → TPM. You'll usually see the failing command with a timestamp. Cross-reference against your BIOS update times or scheduled tasks.
If the TPM still refuses to initialize after a full clear and cold boot, and your firmware is current, you're likely looking at a hardware fault. Discrete TPM chips (the little 14-pin SOIC on the motherboard) do die, especially after a bad firmware flash. On a laptop that's a motherboard replacement. On a desktop with a TPM header, you can usually swap the module for under $25. If you're still under warranty, open the case with your OEM — this error plus failed re-init is a documented justification for TPM hardware replacement.
One more thing: if you've got a virtual TPM in a Hyper-V or VMware VM, this error means the vTPM state file is stale. Shut the VM down (not save state), delete the .vTPM blob from the VM's folder, and let it regenerate on next boot. Don't try to clear it from inside the guest — that path can deadlock the host hypervisor.