0X80280008

TPM_E_DISABLED_CMD (0x80280008): Fix the Disabled TPM Command Error

EP
Erropedia Team
📅 August 26, 2026 📅 Updated Sep 12, 2026 👁 27 views Windows Errors Intermediate
TPM_E_DISABLED_CMD appears when Windows or an app tries to run a TPM command that your firmware turned off. Here's how to re-enable it.

You're running tpm.msc or trying to set up BitLocker, and instead of the usual "TPM is ready" screen, you get a red box with TPM_E_DISABLED_CMD (0x80280008). The exact wording is "The target command has been disabled." This usually hits right after a BIOS update, a CMOS reset, or when you've been poking around in the firmware settings and accidentally turned off one of the TPM sub-features. I've also seen it on Dell and Lenovo machines where the default TPM settings are oddly restrictive.

What's actually happening here is that your TPM chip is present and functional, but the specific command your OS or app is trying to issue—like TPM2_Startup or TPM2_GetCapability—has been explicitly disabled at the firmware level. The TPM spec allows manufacturers to lock down individual commands, and some BIOS implementations do this by default. Windows 11 doesn't love that, and neither does BitLocker.

Root Cause: It's Not a Driver Issue

Most people assume this is a driver problem and go install the latest TPM driver from Intel or AMD. That won't help, because the error comes from the TPM itself. The firmware on the TPM is what decides whether a command is allowed to run. If the command is disabled in the ACPI tables or in the TPM's NV storage, no software workaround will override it. The fix has to happen in your computer's UEFI/BIOS settings.

On many systems, the TPM settings are buried under a submenu called "Intel Platform Trust Technology" (on Intel boards) or "AMD CPU fTPM" (on AMD boards). Inside that submenu, you'll see options like "TPM Device," "TPM State," or "Disable TPM Command." The last one is the culprit. If it's set to "Enabled," that's telling the TPM to block the command. Yes, it's counterintuitive—"Disable TPM Command" set to "Enabled" means the command is disabled.

The Fix: Re-enable the Command in Firmware

Here's the step-by-step. I'm assuming you're on a desktop or laptop with a standard UEFI BIOS. The exact labels vary by manufacturer, but the logic is the same.

  1. Restart your computer and press the key to enter BIOS setup. Common keys are Del, F2, or F10. On Windows 11, you can also go to Settings > System > Recovery > Advanced Startup, then choose "Troubleshoot > Advanced options > UEFI Firmware Settings."
  2. Look for a section named "Security," "Trusted Computing," or "TPM." On Lenovo ThinkPads it's under "Security > Security Chip." On Dells it's "Security > TPM 2.0 Security." On ASUS ROG boards it's "Advanced > Trusted Computing."
  3. Inside, find the setting that controls individual TPM commands. It might be called "Disable TPM Command," "TPM Command Control," or "Allow TPM Commands." If it's set to "Enabled" (which disables the command), change it to "Disabled." If you see a list of specific commands (like "TPM2_Startup"), make sure they're all set to "Allow" or "Enabled."
  4. If you don't see a command-specific option, look for a master switch like "TPM Device" or "TPM State." Set it to "Enabled." Also check that "TPM Activated" is "Enabled." Sometimes just toggling the TPM off, saving, rebooting, then going back in and turning it on will reset the command flags.
  5. Save your changes (usually F10) and exit. Windows will boot normally. Now open tpm.msc again or run Get-Tpm in PowerShell. The error should be gone.

If You're on a Dual-Boot or Virtual Machine

If this error appears in a VM, like Hyper-V or VMware, the problem is different. The virtual TPM (vTPM) is usually fine, but the host's physical TPM might have the command disabled. You'll need to fix the host's firmware first. Also, if you're using a custom OS like Linux with TPM tools, some commands are disabled by default in the kernel module. That's a separate rabbit hole—check dmesg for TPM errors and load the tpm_tis module with the right parameters.

Still Getting the Error?

If you've re-enabled everything and the error persists, check these three things:

  • BIOS version. A known bug on some Gigabyte and MSI boards causes the TPM command disable flag to stick even after you change the setting. Check the manufacturer's site for a BIOS update that addresses TPM issues. I've seen this fixed by a BIOS flash on a Gigabyte B550 board.
  • Clear the TPM. In Windows, open tpm.msc, and under "Actions," click "Clear TPM." This resets the TPM to factory defaults, which re-enables all commands. You'll need to re-setup BitLocker if it was on. Alternatively, run tpm.msc as admin and follow the prompts.
  • Check the Event Log. Open Event Viewer, go to Windows Logs > System, and filter for source "TPM." Look for event ID 15 or 17. Those events often list the exact command that failed. For example, event ID 17 with data like "Command 0x144" tells you it's TPM2_GetCapability. With that info, you can search your BIOS manual for that specific command toggle.

If none of that works, the TPM firmware itself might be corrupted. On some ThinkPads, you can use the Lenovo Diagnostic tool to reflash the TPM. On other systems, you might need to contact the manufacturer. But honestly, the firmware reflash is rare—the disabled command flag is almost always the cause, and it's almost always fixable in BIOS.

One last thing: don't try to work around this by disabling TPM in Windows. Windows 11 needs it, and BitLocker won't work without it. The proper fix is always at the firmware level.

Related Errors in Windows Errors
0X00000577 Fix ERROR_CURRENT_DOMAIN_NOT_ALLOWED (0x00000577) on Windows 0x00000139 Fix KERNEL_SECURITY_CHECK_FAILURE (0x139) in Windows 11 0X000000FE Fix ERROR_INVALID_EA_NAME (0X000000FE) When Copying Files 0XC0000040 STATUS_SECTION_TOO_BIG (0XC0000040) Fix – Map a Large File
TPM_E_DISABLED_CMD 0x80280008 TPM disabled command TPM command disabled tpm.msc error 0x80280008 fix TPM error 0x80280008 TPM 2.0 disabled command enable TPM command firmware BitLocker TPM error 0x80280008 Windows 11 TPM disabled command TPM provisioning error

Was this solution helpful?

EP
Erropedia Team
Tech Support Editors
The Erropedia editorial team researches and documents real-world tech errors from across Windows, Linux, macOS, networking, databases, cloud platforms, and more. Every solution is reviewed for accuracy and updated as software and systems evolve.