Fix TPM_E_KEY_OWNER_CONTROL 0x80280044

Quick answer

Run Clear-Tpm in PowerShell as admin, then reinitialize TPM with Initialize-Tpm. If that fails, reboot into UEFI and clear the TPM from there — this bypasses Windows-level ownership conflicts.

What's actually happening here

You're getting 0x80280044 — TPM_E_KEY_OWNER_CONTROL — when you try to evict a key from the TPM. The TPM itself is saying: “Sorry, the owner tied this key to my authorization secret. You can't remove it without proving you're the owner.”

This usually happens after a system board replacement, a Secure Boot state change, or when BitLocker's TPM protector gets orphaned. On Windows 10 22H2 and Windows 11 23H2, the TPM retains the owner authorization from the original system state. If you try to evict a key without that auth (like using tpmvscmgr or WMI), you'll hit this wall.

The real issue: Windows doesn't always give you a clear path to supply the owner auth when evicting keys. The TPM's owner authorization is a 20-byte secret that Windows stores in the registry. If that gets corrupted or doesn't match what the TPM expects, you're stuck.

Fix steps

Open PowerShell as Administrator — not as a regular user, and not Command Prompt. TPM management commands only work in PowerShell.
```
Get-Tpm
```
Check OwnerClearDisabled. If it's True, you need to enable TPM owner clearance first.
Clear the TPM — this wipes all keys, including the stuck one.
```
Clear-Tpm
```
You'll be prompted to restart. Do it. During reboot, the UEFI may ask you to press F12 or a key to confirm the TPM clear. This is normal.
Initialize the TPM — after reboot, run:
```
Initialize-Tpm -AllowClear -AllowPhysicalPresence
```
This sets a new owner authorization and re-enables the TPM for BitLocker and other services.
Verify
```
Get-Tpm
```
Check TpmReady is True and OwnerClearDisabled is False.

Alternative fixes if the main one fails

UEFI TPM clear — reboot, hit Del/F2 to enter UEFI, find the TPM or Security tab, look for “Clear TPM” or “Factory Reset TPM”. This is the nuclear option and works even when Windows can't talk to the TPM. Works on Lenovo ThinkPads (T490, X1 Carbon) and Dell OptiPlex 7080 — seen it fail on HP ProBook 450 G8 unless you also disable TPM in UEFI first.
Reset via Group Policy — if OwnerClearDisabled is stuck True, check gpedit.msc → Computer Configuration → Administrative Templates → System → Trusted Platform Module Services. Enable “Turn on TPM backup to Active Directory Domain Services” and force a GP update with gpupdate /force. Then retry Clear-Tpm.
Driver rollback — sometimes the TPM driver itself is the culprit. Open Device Manager, find Security Devices → Trusted Platform Module 2.0, right-click → Properties → Driver → Roll Back Driver. Seen on AMD Ryzen systems after a Windows cumulative update (KB5034765 on Windows 11).
Registry nuke — last resort. Open regedit, go to HKLM\SYSTEM\CurrentControlSet\Services\TPM\. Export the key as backup. Delete the WMI subkey. Reboot. Then run Clear-Tpm again. This wipes Windows' cached TPM state, forcing a fresh handshake.

Prevention tip

Don't let your TPM owner authorization get out of sync. If you replace a motherboard or upgrade firmware, always clear the TPM before the hardware swap, not after. For BitLocker users: suspend BitLocker first with Manage-bde -protectors -disable C: (or the full drive letter), then clear TPM, then re-enable protectors. This avoids the orphan key problem entirely. Also, on Windows 11 24H2, Microsoft finally added a “Clear TPM” button in the Settings app under Privacy & security → Windows Security → Device security → Security processor details. Use it — it's less error-prone than PowerShell when you're not comfortable with commands.