TPM_E_INAPPROPRIATE_ENC (0X8028000E) fix – encryption mismatch

When does this error show up?

You're trying to enable BitLocker, or maybe a security app like a VPN client that uses the TPM chip (common on Dell Latitude 7490 or Lenovo ThinkPad X1 Carbon Gen 8). You click "Turn on BitLocker" and instead of a smooth setup, you get a pop-up screaming TPM_E_INAPPROPRIATE_ENC (0X8028000E) — "Unacceptable encryption scheme."

The exact trigger? BitLocker wants AES-128 or AES-256, but your TPM chip's encryption algorithm is set to something else — often RSA or SHA-1 that doesn't match. This isn't a random fluke. It's a deliberate mismatch between what the software requests and what the TPM hardware offers.

Root cause in plain English

Your TPM chip has a built-in encryption algorithm that it uses to generate and store keys. Windows or your app says, "Hey, I need AES-128 encryption," and the TPM says, "Sorry, I'm configured for RSA-2048." The system refuses to proceed because mixing encryption schemes breaks security.

Most often this happens after a BIOS update, a TPM firmware upgrade, or when you mess with TPM settings in the BIOS — maybe you toggled something like "TPM Device Select" or "TPM Encryption Algorithm" without realizing it. The factory default on most systems is AES-128. If someone or something changed it, you get this error.

The fix — clear the TPM and reset encryption

Important warning: Clearing the TPM removes all keys and certificates stored in it. That means BitLocker will ask for your recovery key, and any app using TPM certificates will need re-enrollment. Have your BitLocker recovery key handy (saved to your Microsoft account or a USB drive) before you do this. If you don't have it, don't proceed — you'll lose access to encrypted drives.

Here's the step-by-step. I do this on Windows 11 22H2 and 23H2, but it works on Windows 10 20H2+ too.

Open the TPM management console.
Press Win + R, type tpm.msc, and hit Enter. You'll see the TPM Management on Local Computer window. Look at the status line. It should say "The TPM is ready for use" or maybe "The TPM is on and ownership is taken." Write down the TPM manufacturer and version (e.g., "TPM 2.0, Infineon") — you'll need it later.
Clear the TPM.
In the right-hand Actions pane, click "Clear TPM..." A dialog warns you about losing keys. Click "Clear TPM and restart." Your PC will reboot immediately. Do not interrupt the restart. During boot, you'll see a blue screen saying "Press a key to clear the TPM." Press the spacebar or Enter (your specific key is on screen). The system finishes clearing, then boots normally.

After reboot, Windows recognizes the TPM as empty — no encryption scheme set yet.
Reinitialize TPM with correct encryption.
Open tpm.msc again. You'll see a message: "Compatible TPM cannot be found." That's normal. In the Actions pane, click "Prepare the TPM..." Windows will automatically initialize it using the default AES-128 encryption scheme. Wait a few seconds — you'll see "The TPM is ready for use."
Verify encryption scheme.
Open PowerShell as Administrator (right-click Start, select Windows Terminal (Admin)). Run this command:
```
Get-Tpm
```
Look for the line TpmReady — should say True. Also check ManufacturerSpecVersion. If it's not empty, the TPM is ready. To confirm the encryption algorithm, run:
```
Get-TpmEndorsementKeyInfo
```
You should see Algorithm: AES or Algorithm: RSA depending on your TPM. For BitLocker, AES is what it expects. If it shows RSA, you need to check BIOS settings.
If still RSA — change BIOS setting.
Reboot and enter BIOS (usually F2 or Del). Look under Security > TPM Settings. Find an option like "TPM Encryption Algorithm" or "TPM Device Select". Set it to AES (or AES-128 if you have a choice). Save and exit. Boot into Windows, then repeat steps 1–3 to clear and reinitialize again. Now Get-TpmEndorsementKeyInfo should show AES.

What if it still fails?

Check your BIOS version. Some older BIOS (pre-2023) on Dell and HP systems have a bug where the TPM encryption setting doesn't stick after clear. Update your BIOS to the latest from the manufacturer's site — that fixed it for a user with a Dell Precision 3561. Also disable Secure Boot temporarily (then re-enable after clearing) — yes, it's weird, but it helped on some Lenovo ThinkPads.

If BitLocker still complains, try manually specifying the encryption algorithm. Run this in admin PowerShell:

Manage-bde -on C: -EncryptionMethod Aes128

Replace Aes128 with Aes256 if that's what you wanted. This tells BitLocker to use AES-128 regardless of TPM's endorsement key. After that, the TPM error should vanish.

Still stuck? Check the TPM event log. Open Event Viewer, go to Applications and Services Logs > Microsoft > Windows > TPM-WMI > Admin. Look for event ID 1 or 2 — they'll tell you exactly what encryption scheme the TPM is offering. If it's something like SHA-1, you're on a very old TPM 1.2 chip — you can't change it. Replace the motherboard or use a software-based BitLocker (Group Policy: turn off TPM for BitLocker).