Quick answer: For advanced users – open tpm.msc, right-click the TPM, select “Clear TPM”, reboot, and then update your BIOS/UEFI firmware to the latest version. That resolves the majority of 0x80280400 cases.
That error shows up when Windows tries to run a TPM command but the chip answers back with “blocked”. Usually because the TPM firmware is in a weird state, or a previous command left something hanging. I've seen it most often on Dell and Lenovo laptops right after a Windows update, or when BitLocker tries to re-encrypt after a recovery event. The chip isn't broken – it's just confused. The fix is to reset it and then make sure the firmware is current.
Fix 1: Clear the TPM from Windows
This is the safest place to do it because Windows handles the reset gracefully. You'll lose any TPM-backed keys, so if you use BitLocker, decrypt the drive first or have your recovery key ready. Here's the path:
- Press Win + R, type
tpm.msc, and hit Enter. The TPM Management window opens. You should see the TPM version and status – if it says “TPM is ready for use”, you're in the right spot. - In the right-hand pane under “Actions”, click “Clear TPM…”. A warning pops up – read it, then click “Restart”.
- Your PC reboots and shows a blue screen with instructions. Press F12 (or the key shown on screen) to confirm you want to clear the TPM. This is a physical confirmation, so you must be at the keyboard.
- After the reboot, Windows re-initializes the TPM automatically. Give it a minute. Then check tpm.msc again – it should say “TPM is ready for use”. Try whatever command was failing.
Expected outcome: After the reboot, you'll see the TPM status as ready. The 0x80280400 error should be gone. If not, move to Fix 2.
Fix 2: Update Your BIOS/UEFI Firmware
If clearing the TPM didn't stick, or the error returns after a reboot, the TPM firmware is likely outdated. TPM firmware updates come bundled with BIOS updates. Check your motherboard or laptop manufacturer's support site for the latest BIOS. For example, on a Dell XPS 13, you'd go to Dell's support page, enter your service tag, and look under “Drivers & Downloads” for “BIOS”.
Install the BIOS update as you normally would – often an .exe you run from Windows, or a .bin file you put on a USB stick and flash from the UEFI interface. Reboot after the update, then enter the UEFI setup (usually F2 or Del during boot) and look for a TPM setting. It might say “TPM Device” or “Security Chip”. Set it to “Enabled” if it isn't already. Save and exit.
Expected outcome: After the BIOS update, Windows should recognize the TPM again. I've seen this fix on systems where clearing the TPM only worked temporarily – the firmware patch addresses the underlying bug that caused the blocking in the first place.
Alternative Fixes That Sometimes Work
Run the TPM Diagnostics
Windows has a built-in TPM diagnostics tool that can catch issues. Open PowerShell as administrator (right-click Start, select “Windows PowerShell (Admin)”). Run:
Get-TpmThat gives you a status report. Look for TpmReady – it should be True. If it's False, the output will tell you which part is failing. You might see AutoProvisioning set to False, in which case run:
Initialize-TpmThat forces the TPM to be set up again. Reboot and test.
Check for Pending Flags
Sometimes the TPM has a pending operation that never finished. Open an elevated Command Prompt and type:
tpmtool getdeviceinformationLook for “Pending TPM Operation” – if it shows anything other than “None”, you can clear it with:
tpmtool clearThat's a more direct way to clear the TPM than the GUI, and it works even if tpm.msc gives you an error.
Disable and Re-Enable the TPM in UEFI
If you're comfortable in the UEFI setup, you can force a hardware reset. Boot into the UEFI (as above), find the TPM setting, set it to “Disabled”, save and exit, boot fully into Windows, then shut down completely (not restart). Re-enter UEFI, set it back to “Enabled”, save and exit. This physically resets the TPM's state machine. It's more intrusive, but I've used it on stubborn systems that ignored software clears.
Prevention Tips
Once you've cleared the error, here's how to avoid it coming back:
- Keep your BIOS current. Set a reminder to check for updates every few months. Most manufacturers release TPM firmware fixes along with security patches.
- Don't downgrade Windows versions. Moving from Windows 11 back to Windows 10 can leave the TPM in an undefined state. If you must downgrade, clear the TPM first.
- Watch out for odd power states. If your PC goes into hibernate or sleep during a BitLocker operation, that can trigger this error. Let the operation finish before letting it sleep.
- If you're using BitLocker, keep your recovery key somewhere safe. After clearing the TPM, you'll need it to unlock the drive on the next boot. Write it down or store it in your Microsoft account.
The real fix is clearing the TPM and updating firmware. Don't overthink it – the chip isn't dead, it's just stuck. Follow the steps in order, and you'll be back to normal in under an hour.