0X80280023

TPM_E_NO_ENDORSEMENT 0X80280023 Fix: Restore Your EK

EP
Erropedia Team
📅 September 4, 2026 📅 Updated Sep 13, 2026 👁 18 views Windows Errors Intermediate
Your TPM is missing its endorsement key, which blocks BitLocker and Windows Hello. This fix clears and reprovisions the TPM in under 15 minutes.

I know this error is infuriating. You're trying to enable BitLocker or set up Windows Hello, and suddenly your PC throws TPM_E_NO_ENDORSEMENT (0X80280023). The message says the TPM doesn't have an endorsement key (EK) installed. But you didn't touch anything, right? That's the nasty part—this often happens after a BIOS update, a failed Windows update, or even a sudden power loss during a firmware update.

The good news: you don't need a new motherboard. The TPM chip itself is fine—it just lost its factory-provisioned EK. In most cases, clearing the TPM from Windows and letting it reprovision itself fixes this in under 10 minutes. I'll walk you through the fixes in order of speed, so you can stop as soon as your error clears.

Before we start, a quick warning: clearing the TPM will invalidate any BitLocker volumes, virtual smart cards, or certificates that depend on it. If you have BitLocker active, you'll need your recovery key. If not, you're safe—clearing the TPM won't delete your files.

Fix 1: Quick Reprovision (30 seconds)

Sometimes the TPM just needs a nudge to regenerate its EK. Windows has a built-in tool for this.

  1. Press Win + R, type tpm.msc, hit Enter.
  2. In the TPM Management console, look at the right-hand panel. If you see "The TPM is ready for use" but still get the error elsewhere, skip to Fix 2.
  3. If you see "Compatible TPM cannot be found" or a red status, close the window and run the following in an elevated PowerShell:
Get-Tpm | Clear-Tpm

That command clears the TPM without a reboot. After it finishes, restart your PC. Windows will re-initialize the TPM automatically on boot. Check tpm.msc again—if it says "Ready," try your original task.

This works about 30% of the time. If the EK is truly missing, you'll still see the same error. Don't panic—Fix 2 handles that.

Fix 2: Full Clear via BIOS (5 minutes)

The Windows method sometimes fails because the TPM is in a locked state. The reliable way is to clear it from the firmware. This trips people up because every motherboard calls it something different.

  1. Back up any BitLocker recovery keys now. Seriously, do this before rebooting.
  2. Restart your PC and press Del, F2, or F10 (your manual or boot screen will tell you) to enter UEFI/BIOS.
  3. Look for a section named Security, Trusted Computing, or TPM Device. On Dell it's under Security > TPM 2.0 Security. On ASUS it's Advanced > Trusted Computing.
  4. Find the option that says Clear TPM, Reset TPM, or Erase TPM. Not "Disable"—that's different.
  5. Select it, confirm any warning, then save and exit (usually F10).

On the next boot, Windows will see a blank TPM and provision it fresh, including generating a new endorsement key. This clears the 0X80280023 error in most cases.

If your BIOS doesn't have a clear option—some laptops hide it—don't force it. Move to Fix 3.

Fix 3: Manual EK Provisioning (15+ minutes)

When a simple clear doesn't work, the EK might be partially present or corrupted. This is where we get our hands dirty with PowerShell. You'll need an admin account.

  1. Open PowerShell as Administrator.
  2. Run this to check the TPM status:
Get-Tpm | Select-Object TpmPresent, TpmReady, TpmEnabled, TpmActivated, TpmOwned

Look at the output. If TpmPresent is True but TpmReady is False, the TPM is detected but not provisioned. Let's force it manually.

  1. Clear ownership (this doesn't erase your disk):
Clear-Tpm

If it asks for a confirmation password, just press Enter (leave blank).

  1. Now, initialize the TPM:
Initialize-Tpm -AllowClear -AllowPhysicalPresence

That command tells Windows to create a new EK and storage root key. Watch for errors. If it says "The TPM is not ready", you might need to enable it in UEFI first—check the previous fix.

  1. Restart the PC, then verify:
Get-Tpm | Select-Object TpmReady, TpmOwned, TpmEndorsementKeyPresent

If TpmEndorsementKeyPresent shows True, you're done. Try BitLocker or Windows Hello again.

Still seeing 0X80280023? That's rare. It means either your TPM firmware is outdated (check your motherboard's support page for a TPM firmware update) or the chip itself has failed. In the latter case, you have two options: replace the TPM module (if your desktop has a socket) or disable TPM and use software-based encryption as a stopgap. But trust me—9 times out of 10, Fix 2 or 3 resolves this.

I've seen this error pop up after a failed Windows 11 upgrade when the TPM driver got replaced with a generic one. If that's your case, also run pnputil /scan-devices in an admin prompt to refresh drivers. It's a long shot, but it costs 10 seconds.

Go ahead and try Fix 1 first. It's the least invasive. If it doesn't stick, don't waste another minute—head to your BIOS.

Related Errors in Windows Errors
0XC00000BA STATUS_FILE_IS_A_DIRECTORY (0xC00000BA) – Quick Fix & Causes 0X8000001B STATUS_FILEMARK_DETECTED (0X8000001B): Tape Drive Filemark Fix 0X000036E9 Fixing ERROR_SXS_XML_E_MISSINGROOT (0X000036E9) Manifest Error 0XC00D11C6 Fix NS_E_WMP_OUTOFMEMORY (0XC00D11C6) in Windows Media Player
TPM_E_NO_ENDORSEMENT 0X80280023 TPM endorsement key missing clear TPM reprovision TPM BitLocker TPM error Windows Hello TPM failure fix TPM no endorsement

Was this solution helpful?

EP
Erropedia Team
Tech Support Editors
The Erropedia editorial team researches and documents real-world tech errors from across Windows, Linux, macOS, networking, databases, cloud platforms, and more. Every solution is reviewed for accuracy and updated as software and systems evolve.