Fix TPM_E_BAD_VERSION 0x8028002E on Windows

TPM_E_BAD_VERSION (0x8028002E) means the TPM command you're sending doesn't match the chip's version. Usually it's a Windows/driver mismatch, not dead hardware. Here's how to fix it without wiping your drive.

You're trying to enable BitLocker, set up Windows Hello, or install Windows 11, and Windows throws TPM_E_BAD_VERSION (0x8028002E). The message reads something like "The TPM cannot perform this version of the capability." That phrasing is the whole clue. What's actually happening here is that the software is sending a TPM command with a version field the chip doesn't understand — usually because Windows is talking to the TPM in 1.2 mode when the chip is 2.0, or vice versa.

I've seen this hammer a Dell Latitude 5490 fleet after a BIOS update reset the TPM to 1.2 mode, and again on a custom-built Ryzen 7000 box where the fTPM was disabled in BIOS and Windows was falling back to a stale driver. The hardware was fine both times. Here's how to work through it.

30-Second Fix: Clear the TPM in Windows

Nine times out of ten, the TPM just has stale ownership data or a corrupted state from a firmware flash or a Windows feature update. Clearing it resets the chip to a clean state so Windows can re-negotiate the version handshake.

Press Win + R, type tpm.msc, hit Enter.
In the right pane, click Clear TPM.
You'll get a warning that BitLocker and other key protectors will break. If BitLocker is on, suspend it first or you'll need your recovery key on next boot.
Reboot when prompted. Windows will re-take ownership on the next boot.

If tpm.msc shows "The TPM is not ready for use" or the Clear button is grayed out, skip ahead — the chip isn't even in a state where this works.

After rebooting, run this in an elevated PowerShell to confirm the version Windows now sees:

Get-Tpm | Select-Object TpmPresent, TpmReady, ManufacturerVersion, ManufacturerIdTxt, SpecVersion

If SpecVersion reads 2.0 and TpmReady is True, you're done. If it still shows 1.2 on a chip you know is 2.0, keep reading.

5-Minute Fix: Force TPM 2.0 in BIOS/UEFI

This is where most of these errors actually live. The chip supports 2.0, but the motherboard firmware is presenting it to Windows in 1.2 compatibility mode, or the fTPM (AMD's firmware TPM) is disabled entirely and Windows is falling back to an older discrete TPM driver.

The reason step 2 works is that the TPM version isn't a hardware property Windows can detect independently — it's negotiated at boot by the platform firmware. If BIOS says "report as 1.2," Windows believes it.

Reboot into BIOS. The key varies: F2 on Dell, F10 on HP, Del on most ASUS/MSI/Gigabyte boards, F1 on older Lenovo ThinkPads. Look for one of these menus:

Dell: Security → TPM 2.0 Security → TPM On, and set "TPM 1.2/2.0" to 2.0.
HP: Security → TPM Embedded Security → set "TPM Device" to Available and "TPM State" to 2.0.
Lenovo: Security → Security Chip → set to TPM 2.0, not "TPM 1.2" or "Discrete TPM".
AMD Ryzen: Advanced → AMD fTPM Configuration → set "Firmware TPM" to Enabled. Older BIOS revisions label it "PTT" (Intel Platform Trust Technology) on Intel boards instead.

Save and exit. Boot into Windows and run the Get-Tpm command again. If SpecVersion flipped to 2.0, you're done.

One gotcha: on some boards, switching TPM mode automatically clears the TPM — which means BitLocker recovery keys are invalidated. Suspend BitLocker before you touch BIOS.

15-Minute Fix: Firmware, Drivers, and the Weird Cases

If BIOS already says 2.0 and Get-Tpm still shows 1.2 (or the chip refuses commands with 0x8028002E), you're in the murky territory. Work through these in order.

Update the TPM firmware

TPM chips have their own firmware, and vendor bugs absolutely cause version negotiation failures. In Device Manager (devmgmt.msc), expand Security devices, right-click your TPM, and check the driver version. Then go to your OEM's support page — not Windows Update — and grab the TPM firmware updater. Dell ships one as "Dell TPM 2.0 Firmware Update Utility." Lenovo has one under "ThinkPad TPM Firmware." HP calls it something like "Infineon TPM Firmware Update."

The upgrade path matters. You cannot flash TPM 1.2 firmware directly to 2.0 on most Infineon chips — you go to the latest 1.2, then flash the 2.0 upgrade package, then the latest 2.0. Skipping the intermediate step bricks the chip and you'll be RMA'ing the board.

Remove and re-enumerate the TPM device

Sometimes Windows has a stale driver bound to the chip. In Device Manager, right-click the TPM under Security devices → Uninstall device (tick "Delete the driver software"). Reboot. Windows will re-detect and reinstall. If it comes back as "Trusted Platform Module 1.2" on hardware you know is 2.0, the driver package is wrong — install the vendor's TPM driver manually.

Check for PCR bank conflicts

Windows Hello and BitLocker write to PCR banks on the TPM. If BIOS is configured to expose PCR banks that the chip's firmware doesn't fully implement, commands targeting those banks return 0x8028002E. Run this elevated:

tpmtool getdeviceinformation

Look at the "TPM has SHA-1" / "TPM has SHA-256" lines. If the chip claims only SHA-1 but Windows is trying to use SHA-256 PCR banks (which happens on some 2016–2018 Intel PTT implementations), you need a firmware update from the OEM. There's no Windows-side fix.

The nuclear option: full TPM reset via BIOS

If nothing else works, go back into BIOS and look for Clear TPM or Reset TPM to Factory Defaults. On Dell it's under Security → TPM 2.0 Security → "Clear TPM." On ASUS it's under Advanced → PCH-FW Configuration → "Pending TPM Operation." This is deeper than the Windows-level clear in step 1 — it forces the chip's internal state machine to reset, which sometimes unsticks a version handshake that got wedged.

You'll lose all TPM-stored keys. Back up BitLocker recovery keys before doing this. Sign back into Microsoft account, make sure the recovery key for each protected drive is saved somewhere you can read without the TPM (phone, password manager, printed paper).

When it's genuinely hardware

Rare, but it happens. If Get-Tpm reports TpmPresent: True but TpmReady: False permanently after a clear, and BIOS shows the chip as present but not responding, the chip itself has failed. On discrete TPM modules (the little daughterboard on older ThinkPads and Dells), you can swap the module. On fTPM (AMD/Intel PTT), it's the CPU or the motherboard firmware — usually the latter.

One last thing people miss: TPM 1.2 can't do anything Windows 11 asks of it. If you're hitting 0x8028002E during a Windows 11 upgrade and your chip is truly 1.2 with no 2.0 upgrade available, you're not fixing this. You're buying a TPM 2.0 module or a new board. Windows 11's requirement is 2.0, full stop, and no registry bypass changes what the chip supports.