0X8028003A

TPM_E_KEY_NOTSUPPORTED 0x8028003A: Quick NV Key Fix

This TPM error halts NV key loading. Usually a firmware or driver mismatch. We'll clear TPM, update, or use PowerShell to fix it.

Quick Answer

Reset the TPM to factory defaults—either via Windows Security or the BIOS—then retry the operation. That clears the stale NV key state and usually solves it instantly.

Why This Happens

I've seen this error pop up in three scenarios: after a Windows feature update, right after a TPM firmware update, or when a game's anti-cheat (like Easy Anti-Cheat) tries to load an NV key that's already in use or mismatched. The TPM stores keys in its non-volatile memory, and when the key's metadata doesn't match what the software expects, you get 0x8028003A. It's not a hardware failure—your TPM chip is fine. It's just a key state conflict. I know it's infuriating because the error message is cryptic and doesn't tell you which key or operation failed.

The trigger is often a change in the TPM's firmware or a Windows update that alters the TPM driver. A friend of mine hit this after updating to Windows 11 23H2 on an AMD system—BitLocker wouldn't unlock, and we saw this exact code in the event log. Another common one: people enabling TPM for the first time for Windows 11 and then trying to load a pre-existing key.

Fix Steps (Main Solution)

  1. Clear the TPM from Windows (easiest)
    Press Win + R, type tpm.msc, hit Enter. In the TPM Management console, click Clear TPM on the right. You'll need to restart. This resets the TPM to factory state, wiping all keys—including the problematic NV key.
  2. Clear via BIOS if Windows won't boot
    If you can't get into Windows, reboot into your BIOS/UEFI (usually Del or F2). Look for a setting named Clear TPM, Reset TPM, or Factory Defaults under Security or TPM options. Select it, save, and exit. This works on Dell, HP, Lenovo, and ASUS boards I've used.
  3. Retry the operation
    After the restart, the TPM will re-provision automatically. Try loading the NV key again—whether it's BitLocker, a game, or a custom app. If it still fails, move to the alternative fixes.

Alternative Fixes (If Main Doesn't Work)

Update TPM Firmware

Sometimes the error is a bug in the TPM firmware itself, and a newer version fixes it. Check your motherboard manufacturer's support page for a TPM firmware update. For Intel AMT systems, they often push updates via the Intel Management Engine (ME) driver. I've seen this on Lenovo ThinkPads—a firmware update from 1.3.2 to 1.3.5 eliminated the error for good.

Disable and Re-enable TPM in BIOS

Reboot, enter BIOS, find the TPM setting (often under Security > TPM). Set it to Disabled, save, boot to Windows, then shut down. Re-enter BIOS, set it back to Enabled, save, and boot. This forces a fresh initialization.

Use PowerShell to Clear TPM (Advanced)

If the GUI methods fail, you can try the command-line route. Open PowerShell as Administrator and run:

Clear-Tpm

This is the same as the GUI Clear, but sometimes the cmdlet bypasses a stuck UI. Then restart. Also, check if any anti-cheat software like Valorant's Vanguard is interfering—temporarily uninstall it, clear TPM, then reinstall.

Check Event Log for More Clues

Open Event Viewer, go to Windows Logs > System, and filter for source TPM. Look for event ID 17 (TPM event) or 6 (TPM provisioning). The details might mention a specific key index or a parent key that's invalid. That can point you to whether it's a key load vs. a create operation.

Prevention Tip

The biggest cause is a firmware or driver update that changes the TPM's internal state without cleaning up old keys. So whenever you update your BIOS or Windows, take a moment to check if your TPM firmware is also updated. And if you're moving a BitLocker drive between systems, export your recovery key first—clearing the TPM will invalidate it, and you'll need that key to unlock the drive after the reset.

Also, be consistent: don't mix TPM drivers from different sources. Stick to the ones from your motherboard vendor or Windows Update. I've seen manual driver installs break things more often than they fix them.

If you're still stuck, don't panic—the TPM is resilient. A full TPM reset (Clear + re-provision) has fixed this for every client I've worked with. Give it a shot and you should be back up in minutes.

Related Errors in Windows Errors
0X800401F5 CO_E_APPNOTFOUND (0X800401F5) Fix Guide 0X00002083 Fix ERROR_DS_ATT_VAL_ALREADY_EXISTS (0X00002083) 0XC000017B STATUS_INVALID_MEMBER (0XC000017B) - Fix Wrong Account Type in Groups 0XC000012A STATUS_THREAD_NOT_IN_PROCESS (0XC000012A) – 3 Fixes That Actually Work

Was this solution helpful?

EP
Erropedia Team
Tech Support Editors
The Erropedia editorial team researches and documents real-world tech errors from across Windows, Linux, macOS, networking, databases, cloud platforms, and more. Every solution is reviewed for accuracy and updated as software and systems evolve.