TPM_E_INVALID_AUTHHANDLE (0x80280022) — Fix the Invalid Handle

1. Stale Authentication Handle — Clear the TPM

What's actually happening here is that some program—usually BitLocker, Windows Hello, or a TPM-backed certificate—grabbed a handle to the TPM but didn't release it properly. When another process tries to use that same handle, the TPM says "I don't recognize this handle anymore" and throws 0x80280022. This is common after a driver update or a forced shutdown. The most reliable fix is to clear the TPM via Windows.

1. Press Win + R, type tpm.msc, hit Enter. If the TPM Management console doesn't open, you've got bigger problems (driver missing or TPM disabled in BIOS).
2. In the right-hand panel, click Clear TPM. Windows will warn you: clearing the TPM resets all keys—including BitLocker recovery keys. Make sure you have your BitLocker recovery key backed up (check your Microsoft account or a printed copy). If you're not using BitLocker, you don't need to worry.
3. Restart the machine. During boot, the BIOS will ask you to press a key (usually F12 or Enter) to confirm the TPM clear. Don't skip this step—the OS won't clear it otherwise.
4. Once back in Windows, the TPM will reinitialize with a fresh auth handle space. The error should vanish.

This fixes roughly 70% of cases. The reason step 3 works is that Windows can't clear the TPM while it's using it—the BIOS-level confirmation forces a clean reset without active handles.

2. Corrupted TPM Base Services — Restart the Driver

If clearing the TPM didn't help (or you can't because BitLocker's active and you lost the key), the second most common cause is the TPM base services driver itself going sideways. This happens after a Windows update that partially installed or a third-party security tool that hooks into the TPM.

1. Open Device Manager (Win + X → Device Manager).
2. Expand Security devices. You'll see something like "Trusted Platform Module 2.0." Right-click it and select Update driver → Browse my computer for drivers → Let me pick from a list.
3. Choose the driver listed (usually "Microsoft TPM 2.0") and click Next. This forces a reinstall of the in-box driver, not a manufacturer one.
4. Reboot. Then open an admin PowerShell and run:

   Get-Tpm

   Check that IsEnabled is True and IsActivated is True.

If Get-Tpm shows errors, run:

Stop-Service TBS -Force; Start-Service TBS

I've seen this fix work on Dell Latitude 5420s after a BIOS update. The TPM driver got out of sync with the firmware version—the TBS restart snapped everything back.

3. Application-Specific Handle Leak — Reprovision the App

Less common, but the error can be pinned to a specific app that's holding onto a stale handle. BitLocker is the prime suspect, but Windows Hello for Business or even certain VPN clients (like Cisco AnyConnect with TPM-backed certificates) can cause this.

To narrow it down:

1. Open Event Viewer (Win + R, eventvwr.msc).
2. Go to Windows Logs → System. Filter by Event ID 562 (TPM error) or 0 (TPM initialization failure). Look for the process name that triggered the error—often svchost.exe running a specific service.
3. If it's BitLocker, disable it temporarily:

   Manage-bde -protectors -disable C:

   (replace C: with your drive). Then re-enable:

   Manage-bde -protectors -enable C:

   This forces BitLocker to renegotiate its TPM auth handles.
4. If it's Windows Hello, go to Settings → Accounts → Sign-in options → Windows Hello PIN → Remove. Then set it up again. This clears the biometric and PIN handles tied to TPM.

The reason this works: each app gets a unique auth handle from the TPM on first connection. If the app crashes or the handle expires (TPM max handles is usually 3-5 on Windows), the old handle becomes invalid. Reprovisioning forces a fresh handshake.

The golden rule: never reset the TPM if you don't have your BitLocker recovery key. You'll lock yourself out of the drive. If you're stuck, skip the clear and try the TBS restart first—it's safer and often works.