Fix TPM_E_AREA_LOCKED (0X8028003C) – NV area locked

You've just updated your BIOS, or maybe you tried to clear the TPM from Windows and it half-failed. Now every time you try to provision BitLocker, enroll a certificate, or even just check TPM status, you get 0X8028003C with the message: The NV area is locked and not writable. This is a classic TPM firmware lock – it's not a hardware failure, but the TPM is in a protective state that prevents writing to its non-volatile (NV) storage. The NV area holds things like the endorsement key, owner authorization, and PCR values. When it's locked, you can't change anything.

The root cause is almost always a TPM firmware lock triggered by a BIOS update, a failed TPM clear operation, or a security policy that requires physical presence to unlock. On most systems, the TPM's NV area gets locked after a certain number of failed write attempts or after a firmware update that changes the TPM's internal state. The TPM 2.0 specification says that if the NV area is locked, you need to either reboot the system or use the TPM's physical presence interface to clear it. In practice, the fix is usually simpler: you just need to clear the TPM from the BIOS/UEFI setup, not from Windows.

What not to waste time on

Skip running tpm.msc and clicking “Clear TPM” in Windows – that often triggers this error in the first place. Also skip PowerShell commands like Clear-Tpm or Initialize-Tpm – they'll just throw the same error. The NV area is locked at the firmware level, so you need to unlock it from the firmware interface.

The fix: clear TPM from BIOS/UEFI

Here's the step-by-step that has worked for me on Dell, HP, Lenovo, and custom-build PCs. The exact menu names vary, but the logic is the same.

Boot into your BIOS/UEFI setup. Restart the computer and press the key to enter setup – usually F2, Del, F10, or Esc depending on your motherboard. On Lenovo ThinkPads, press Enter then F1. On Dell, tap F2 repeatedly.
Find the TPM settings. Look under Security, Advanced, or Trusted Computing menus. On Dell OptiPlex machines, it's under Security > TPM 2.0 Security. On HP ProDesk, it's under Security > TPM Embedded Security. On custom boards (ASUS, Gigabyte, MSI), look for “Trusted Computing” or “Security Device Support”.
Locate the “Clear TPM” option. This might be labeled “Clear,” “Reset,” “Factory Reset,” or “Clear TPM Owner Authorization.” Do not confuse this with “Disable TPM.” We want to clear, not disable. On some systems, you may see a sub-option like “Clear TPM” or “TMP Clear” (yes, they typo it sometimes).
Enable physical presence (if required). Some BIOSes require you to set “Physical Presence” to “Enabled” before the clear can happen. This is a security feature – the TPM needs to know a human is physically pressing the buttons. If you see a setting like “TPM Physical Presence” or “TPM Operation” set to “Enabled,” do that first.
Select “Clear TPM” and confirm. The system will usually prompt you to press a key (like F10) to accept. Do it. The machine may reboot once or twice.
Save and exit BIOS. If the system doesn't automatically reboot, do it manually. After the reboot, the TPM should be back to factory default state – NV area unlocked, ready to be used by Windows.

Real-world example: Had a client last month whose entire print queue died because of this – well, not the queue, but their secure print server couldn't enroll its TPM certificate after a Dell BIOS update. Two hours of digging before I realized the NV area was locked. One BIOS clear later, server was back up. The error wouldn't even show in Event Viewer – just 0X8028003C in the TPM PowerShell cmdlets.

If clearing TPM from BIOS doesn't work

Rare, but possible. Some older systems (especially TPM 1.2) may need a physical jumper on the motherboard. Check your motherboard's manual for a “TPM Clear” or “Clear CMOS” jumper. On some Lenovo desktops, you need to short two pins on the TPM module itself. On laptops, there's often no jumper – you're stuck with the BIOS method. If that fails, try updating the BIOS to the latest version – sometimes the TPM firmware gets stuck after a partial update, and a newer BIOS includes a TPM firmware update that resets the NV state.

What to check if it still fails after the fix

Confirm TPM is enabled. After clearing, go back into BIOS and verify TPM is set to “Enabled” (or “On”) not “Disabled” or “Hidden.”
Check TPM status in Windows. Run tpm.msc – it should show “The TPM is ready for use” with no errors. Run Get-Tpm in PowerShell to confirm TpmReady is true and LockoutCount is 0.
If you still see 0X8028003C, try a full power cycle: unplug the AC power, remove the CMOS battery for 30 seconds, then boot. This forces the TPM to reinitialize its internal state. Some motherboards hold a TPM lock even across reboots – only a full power drain resets it.
If you're on a system with a soldered TPM (like many laptops), you may need to use the manufacturer's firmware update tool. Dell, HP, and Lenovo all have TPM firmware updaters that can reset the NV area. Run those before giving up.

If nothing works – and I've seen this maybe twice in 10 years – you're looking at replacing the motherboard or the discrete TPM module. But 99% of the time, the BIOS clear does the trick.