TPMAPI_E_TBS_COMMUNICATION_ERROR (0x8029010B): Fix Windows TBS Errors

You're trying to enable BitLocker on a Dell Latitude 5420, or you're setting up Windows Hello on a Surface Pro 8, and you get hit with TPMAPI_E_TBS_COMMUNICATION_ERROR (0x8029010B). It usually shows up right after a BIOS update, after you swap the motherboard, or on a fresh Windows 11 install where the TPM is enabled in firmware but Windows can't seem to find it. The TPM Management console (tpm.msc) might show "The TPM is ready for use" — and then the moment you click "Prepare the TPM," it throws 0x8029010B in your face. Annoying.

What's Actually Going Wrong

TBS stands for TPM Base Services. It's the Windows service (and kernel driver) that sits between applications and the physical TPM chip. When an app like BitLocker, Windows Hello, or a third-party VPN client asks the TPM to do something — seal a key, sign a challenge — the request goes through TBS. Error 0x8029010B means TBS tried to talk to the TPM and got nothing back. Either the TPM isn't responding, the TBS service isn't running, or there's a driver/firmware mismatch. It's a broken phone line, not a broken TPM.

Common real-world triggers I've seen on the help desk:

• BIOS/firmware update that reset TPM state but didn't clear the old owner information
• Windows Update replacing the TPM driver with a generic Microsoft one that doesn't match your chip
• A motherboard swap where the old TPM keys are still referenced in the registry
• HP EliteBook 840 G8 laptops after a specific BIOS revision (01.09.00) — known issue

The Fix — Step by Step

Step 1: Confirm the TPM is enabled in BIOS/UEFI

1. Reboot and mash F2, F10, Del, or Esc (depends on your vendor) to enter BIOS setup.
2. Look under Security, Advanced, or Trusted Computing. The exact menu name varies — Dell calls it "Security → TPM 2.0 Security," HP calls it "Security → TPM Embedded Security," Lenovo uses "Security → Security Chip."
3. Make sure it says Enabled and the mode is TPM 2.0 (not 1.2). Save and exit.
4. Boot back to Windows. Right-click Start, pick Device Manager, expand Security devices. You should see "Trusted Platform Module 2.0." If it's missing or has a yellow bang, that's your problem.

After you save and reboot, you should see the TPM show up in Device Manager within about 30 seconds of logging in.

Step 2: Restart the TBS service and check its status

1. Press Win + R, type services.msc, hit Enter.
2. Scroll down to TPM Base Services. Double-click it.
3. Startup type should be Manual (Trigger Start). If it's Disabled, change it to Manual.
4. Click Start if it's stopped. Click Apply, then OK.

The service status should read "Running." If it starts and immediately stops, jump to Step 5.

Step 3: Verify TPM state with PowerShell

Open PowerShell as admin and run:

Get-Tpm

You want to see TpmPresent : True and TpmReady : True. If TpmReady is False, run:

Initialize-Tpm -AllowClear -AllowPhysicalPresence

If that fails with the same 0x8029010B, the TBS driver isn't bound to the TPM. Move on.

Step 4: Remove and re-detect the TPM device

1. Open Device Manager (Win+X → M).
2. Expand Security devices, right-click Trusted Platform Module 2.0, choose Uninstall device. Check "Delete the driver software for this device" if it's offered.
3. Back in Device Manager, click Action → Scan for hardware changes.
4. Windows should reinstall the TPM driver. You'll see the device reappear under Security devices within a few seconds.

Step 5: Clear the TPM and re-take ownership

Only do this if you have your BitLocker recovery key saved. Clearing the TPM wipes sealed keys — if you don't have the recovery key, you'll lock yourself out of an encrypted drive.

1. Press Win+R, type tpm.msc, Enter.
2. In the Actions pane on the right, click Clear TPM.
3. You'll be prompted to restart. Reboot the machine.
4. After reboot, Windows may show a black screen asking you to press F1 or F12 to confirm the TPM clear. Press the key your manufacturer specifies.
5. Once back in Windows, open tpm.msc again. It should say "The TPM is ready for use" with ownership taken by Windows.

Step 6: Update TPM firmware from your vendor

This is the one most people skip, and it's often the real fix. TPM firmware bugs cause 0x8029010B more than anything else. Go to your laptop vendor's support page, look up your exact model, and download the TPM firmware update utility. Examples:

• Dell: "Dell TPM 2.0 Firmware Update Utility" under Drivers → Security
• HP: "HP TPM Firmware Update" (sp141617.exe or similar)
• Lenovo: "TPM Firmware Update Utility" under Chipset

Run it, let it reboot, and check tpm.msc again.

If It Still Fails

Try these in order:

• Disable Fast Startup. Control Panel → Power Options → Choose what the power buttons do → Change settings that are currently unavailable → uncheck "Turn on fast startup." Fast Startup sometimes leaves the TPM in a half-initialized state.
• Check the registry. Open regedit and navigate to HKLM\SYSTEM\CurrentControlSet\Services\TPM. The Start value should be 3 (demand start). If it's 4, TBS won't load.
• Run SFC and DISM. A corrupted TBS driver shows up here sometimes:
  sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth
• Check for a physical TPM fault. If Get-Tpm shows TpmPresent : False after everything above, the chip itself has failed. On most business laptops (Dell, HP, Lenovo) the TPM is a separate module — a $15 part you can swap. On consumer machines it's usually soldered to the board, which means a motherboard replacement.
• Last resort: Reset Windows. A clean install clears any leftover TPM ownership registry entries that survived all the above.

Heads up: if you're on a domain and use BitLocker with a TPM protector, coordinate with IT before clearing the TPM. Recovery keys stored in AD or Entra ID will still work, but you'll need them handy.

Nine times out of ten, 0x8029010B on a modern machine is either a stale TPM firmware or a driver that got clobbered by Windows Update. Firmware first, driver second, and you'll be done in under 20 minutes.