TPM_E_NOTFIPS (0X80280036): Fix BitLocker & TPM Errors Fast

What's actually happening here?

TPM_E_NOTFIPS (0X80280036) shows up when Windows asks the TPM to do something that requires FIPS 140-2 compliance, but the TPM either isn't in FIPS mode or the whole platform never got certified. You'll see this most often when enabling BitLocker, setting up Windows Hello, or trying to use the TPM for key storage.

The tricky part: your TPM might be perfectly healthy. Windows just refuses to use it for certain operations unless it meets FIPS standards. And that flag gets set at the firmware level, so you can't just toggle it in Windows.

Here's the thing—on most consumer PCs, especially from 2020 onward, the TPM is actually FIPS-certified. The problem is usually that the TPM isn't initialized or the firmware isn't updated. So we'll start with the quick checks before we go nuking your TPM.

The 30-second fix: Check TPM status and clear it

Open tpm.msc (Win+R, type it, hit Enter). Look at the status. If it says "The TPM is ready for use," you're likely fine—skip to the next section. If it says "Compatibility Mode" or "Not initialized," you've found your problem.

When the TPM is in Compatibility Mode, Windows treats it as a legacy device. That breaks FIPS checks. Here's what to do:

1. Close tpm.msc and any apps using the TPM (like BitLocker or Windows Hello).
2. Open PowerShell as Administrator.
3. Run Clear-Tpm -AllowClear. This resets the TPM to factory state.
4. Reboot. Windows will re-initialize the TPM automatically on next boot.

Why this works: a cleared TPM gets re-provisioned with the correct flags, including FIPS mode if the firmware supports it. If your TPM was stuck in Compatibility Mode, this often flips it to full mode.

If the error persists, or tpm.msc didn't show any warning, move on.

The 5-minute fix: Update TPM firmware from your OEM

This is the one people skip, and it's the real culprit on many Lenovo and Dell machines. The TPM firmware is separate from your system BIOS. If it's outdated, it might not advertise FIPS compliance properly.

Check your manufacturer's support page for a TPM firmware update. For example:

• Lenovo: Look for "TPM firmware update" under Drivers & Software, not BIOS.
• Dell: Search "TPM 2.0 firmware" on Dell Support.
• HP: Similar—separate firmware package from the BIOS.

Install the update with BitLocker suspended (if you use it). Suspend via Manage-bde -Protectors -Disable C: in an admin command prompt. After the update, reboot and check tpm.msc again. The FIPS flag should now be set.

What's actually happening: the TPM firmware contains a certificate that declares FIPS compliance. Older firmware might lack it or have it misconfigured. A fresh firmware often fixes 0X80280036 without touching anything else.

The 15+ minute fix: Enable FIPS mode in BIOS and reset TPM

If you're still stuck, your TPM might genuinely not be in FIPS mode. Some motherboards (especially ASUS and MSI) have a BIOS setting for TPM that isn't obvious. You'll need to dig in.

1. Reboot and enter BIOS (usually Del, F2, or F10 depending on your motherboard).
2. Navigate to Security > Trusted Computing or Advanced > TPM Configuration.
3. Look for a setting called "TPM Device Selection" or "Firmware TPM". Set it to Firmware TPM (if it's on Discrete, switch it).
4. If you see an option for "TPM State" or "Security Device Support", set it to Enabled.
5. Some boards have a "TPM Operation Mode"—set that to FIPS if available. Not all boards have this; if yours doesn't, don't panic.

After changing BIOS settings, you'll need to clear the TPM again. Boot into Windows, run Clear-Tpm -AllowClear in an admin PowerShell, then reboot.

Now, here's the part that takes time: Windows will need to re-enroll TPM protectors for BitLocker. If BitLocker was active, you'll need to resume protection:

Manage-bde -Protectors -Enable C:

And for Windows Hello, you'll have to set up PIN and biometrics again. That's annoying but expected—the old keys got invalidated when the TPM cleared.

When none of this works

If you've done all three and the error persists, the TPM itself might be faulty or your motherboard genuinely doesn't support FIPS. That's rare but possible.

On some older Intel platforms (pre-2018), the default firmware TPM isn't FIPS-certified. There's no software fix. Your options: use a discrete TPM module (if your board has the header), or disable TPM-dependent features and use software-based BitLocker (not recommended).

But before you go there, check whether you actually need FIPS. If the error comes from BitLocker, you can often bypass it by using a startup password instead of TPM-only protection. That's a workaround, not a fix, but it gets you encrypted.

Why this error is so common on Windows 11

Windows 11 made TPM 2.0 mandatory, which surfaced a lot of these errors. Manufacturers rushed to enable TPM in firmware, but not all of them set the FIPS flag correctly. So you're not alone—this is a known issue on specific models from 2021-2022.

The good news: most users get past it with the first or second fix. The TPM firmware update is the one that actually solves it if the quick clear doesn't. Don't skip straight to BIOS fiddling unless you're comfortable.

Final thought

TPM_E_NOTFIPS is a firmware-level flag problem, not a Windows corruption issue. So don't waste time running sfc /scannow or reinstalling Windows—that won't touch the TPM. Stick with the flow above and you'll be back in business.