Fix TPM_E_MA_DESTINATION 0x8028005D Migration Error

When This Error Shows Up

You see 0x8028005D (TPM_E_MA_DESTINATION) when you try to migrate a TPM-protected key — like a BitLocker volume master key — from one machine to another, and the destination TPM doesn't trust the source. The exact trigger: you ran something like Manage-bde -protectors -adbackup C: or used the TPM Migration Wizard to transfer a key, and it failed with this code. This happens most often in enterprise environments where you’re moving a hard drive or a TPM-backed certificate between PCs, but the destination TPM hasn't been prepped to accept the migration.

Root Cause in Plain English

The TPM is paranoid by design. When you create a key on one TPM, it's locked to that chip. To move it to another TPM, both sides need to agree on a shared secret — the Migration Authority. The error 0x8028005D means the destination TPM said “I don’t have the right authorization to accept this key.” This usually happens because:

The Migration Authority password or policy wasn’t set on the destination TPM.
The destination TPM is in a different ownership state (e.g., not initialized, or owned but with a different owner password).
You’re trying to migrate to a TPM that’s in a different security realm (e.g., TPM 1.2 vs 2.0, or different owner auth values).

Fix: Step-by-Step Guide

These steps assume the source TPM has the key you want to migrate, and the destination TPM is on the target machine. You'll need administrator rights on both machines.

Check TPM version on both machines. Open PowerShell as admin on the source and destination. Run Get-Tpm | Select-Object -Property ManufacturerId, ManufacturerVersion, SpecVersion. If the SpecVersion differs (1.2 vs 2.0), direct key migration isn't possible — you'll need to decrypt and re-encrypt the data instead. After running this command, you'll see the version in the output. If they match (both 2.0), continue.
Set the Migration Authority password on the destination TPM. On the destination machine, open an elevated PowerShell window and run:
```
$ownerAuth = Read-Host -AsSecureString "Enter a new owner authorization password"
Set-TpmOwnerAuth -OwnerAuthorization $ownerAuth
```
After running this, you'll see no errors if it succeeds. If you get an error about TPM not being initialized, run Initialize-Tpm first and restart the machine.
Export the Migration Authority from the destination TPM. Still on the destination, run:
```
$ownerAuth = Read-Host -AsSecureString "Re-enter the same owner authorization password"
$ma = Get-TpmMigrationOwnerAuth -OwnerAuthorization $ownerAuth
$ma | Export-CliXml -Path C:\TPM_MA.xml
```
After this, you'll have a file C:\TPM_MA.xml containing the Migration Authority blob. Copy that file to the source machine (USB drive or network share).
Import the Migration Authority on the source TPM. On the source machine (where the key lives), open an elevated PowerShell and run:
```
$ma = Import-CliXml -Path C:\path\to\TPM_MA.xml
Set-TpmMigrationAuthority -MigrationAuthority $ma
```
After running this, the source TPM now knows the destination TPM's authority. You should see no errors.
Perform the key migration. Now run your migration command again. For BitLocker, that's:
```
Manage-bde -protectors -adbackup C:
```
After this, you should see a success message. If you're using a custom tool or script, run that now. The migration should complete without the 0x8028005D error.

If It Still Fails

Three things to check. First, verify the source and destination are both using the same TPM spec version (both 2.0 or both 1.2). You can’t mix them — the TPM stack will reject the cross-version migration every time. Second, confirm the owner authorization password you used on the destination matches exactly what you supplied in steps 2 and 3. One typo and the authority blob is garbage. Third, if you’re migrating a key that’s tied to a specific PCR (Platform Configuration Register) value, like for BitLocker, the destination boot state must match. Boot the destination to the same OS and hardware configuration before retrying. If all else fails, the practical workaround is to decrypt the data on the source, copy it raw, and re-encrypt on the destination — it's brute-force but it bypasses the TPM migration entirely.