TPM_E_DECRYPT_ERROR 0x80280021: Fix Without Wiping Your Drive

You're trying to decrypt a BitLocker drive — maybe you're decommissioning a laptop, or you just got sick of typing that 20-digit recovery key every boot. Windows gets partway through, then throws TPM_E_DECRYPT_ERROR (0x80280021) and stops. The message says “The decryption process did not complete.” You might see it in the BitLocker control panel, or in an admin PowerShell window after running manage-bde -status.

This usually hits after a Windows feature update (like 22H2) or a TPM firmware update that silently changed the TPM's state. The TPM and BitLocker are having a disagreement about keys. The drive isn't broken — your data is probably fine. But the decryption process can't proceed because the TPM is refusing to release the encryption key.

Don't panic and don't format. Let's fix it.

Why this happens

The TPM (Trusted Platform Module) stores a hash of the BitLocker keys. When you decrypt, Windows asks the TPM to unseal those keys. The TPM checks its own internal state — if that state got out of whack (firmware glitch, driver issue, or a botched secure boot update), it returns an error instead of the keys.

The culprit here is almost always a TPM driver mismatch or a pending TPM firmware update that didn't apply cleanly. I've seen this on Dell Latitudes and Lenovo ThinkPads after BIOS updates. Occasionally it's a corrupted TPM context, but that's rarer.

Fix it in order — try these first

Step 1: Make sure you have your BitLocker recovery key

Before touching anything, you need that 48-digit recovery key. If you don't have it saved in your Microsoft account or printed somewhere, stop now and back up the drive using a tool like dd or DiskGenius. You'll probably need it later, and you don't want to be stuck without it.

Step 2: Update the TPM driver

Open Device Manager (devmgmt.msc), expand "Security devices," right-click "Trusted Platform Module 2.0," and choose "Update driver." Select "Search automatically." If Windows finds nothing, go to your laptop manufacturer's support site and grab the latest TPM or chipset driver. I've seen this exact error fixed by a chipset driver update on Intel NUCs.

Step 3: Check the TPM state in PowerShell

Run PowerShell as admin and run:

Get-Tpm

Look at TpmReady and TpmEnabled. If TpmReady is False, the TPM is in a bad state. If AutoProvisioning is enabled, you might be able to clear and re-provision it (but that will invalidate your current BitLocker keys — hence the recovery key).

Step 4: Clear the TPM (the nuclear option)

If the driver update didn't work, you'll need to reset the TPM. This wipes the TPM's stored keys, so BitLocker will lose its mind until you re-establish it. Here's the sequence:

1. Suspend BitLocker first, if you can. Run manage-bde -protectors -disable C: (replace C: with your drive letter). If that fails, skip.
2. Open an elevated PowerShell and run Clear-Tpm -AllowClear. Reboot.
3. Windows will re-initialize the TPM automatically. Check with Get-Tpm — it should show TpmReady: True.
4. Now resume BitLocker protection: manage-bde -protectors -enable C:. You'll need your recovery key to re-seal the key to the new TPM state.
5. Now try decryption again.

This clears the TPM state but doesn't touch your data. Just be sure you have that recovery key.

Step 5: If TPM clearing fails, use manage-bde to force decryption off

Sometimes the TPM is so wedged that even clearing doesn't help. In that case, you can bypass the TPM entirely:

manage-bde -unlock C: -RecoveryPassword [your-48-digit-key]
manage-bde -autounlock -disable C:
manage-bde -protectors -delete C: -type TPM

Then try decrypting again. If the protectors are gone, Windows might just decrypt without a fuss.

Still failing? Check these

• UEFI/BIOS settings: Some systems have a separate TPM configuration (like "TPM Device"). Make sure it's set to "Firmware TPM" or "TPM 2.0" and not disabled.
• Secure Boot state: If Secure Boot got toggled off (maybe during a boot device change), the TPM won't release keys. Re-enable it in BIOS.
• Pending firmware update: Some laptops queue a TPM firmware update that only runs at shutdown. Use the manufacturer's tool to apply it manually (e.g., Lenovo System Update, Dell Command Update).
• Windows Event Log: Check under Event Viewer > Windows Logs > System for events from source "TPM" around the time of failure. Look for error 15 or 17 — that'll point to a specific TPM command failing.
• Run the BitLocker repair tool: repair-bde can recover data to another drive if encryption is stuck, but that's a last resort.

In my experience, the driver update fixes it about 40% of the time. The TPM clear fixes another 40%. The remaining 20% are BIOS-level issues — usually Secure Boot getting flipped. Don't bother with third-party “TPM fix” utilities; they're snake oil.

If you're still stuck after all that, you might have a hardware TPM failure. That's rare but happens. Consider disabling BitLocker via manage-bde -off C: — if that doesn't work, you might need to decrypt on another machine using repair-bde with the recovery key.

Keep your head down, follow the steps in order, and you'll get that drive decrypted. I've seen this error a dozen times — it's annoying but never fatal.