TPM_E_NOTSEALED_BLOB (0x80280013) Fix for Windows

You're booting a Windows 10 or 11 machine, or launching a BitLocker-protected drive, and instead of the usual login you get a cryptic stop code or a Windows Hello failure. The Event Viewer shows TPM_E_NOTSEALED_BLOB (0x80280013). Or maybe you just flashed a new BIOS, swapped the motherboard, or cloned a drive to a new SSD, and now Windows insists the TPM can't unseal the data it needs. I know this error is infuriating—it locks you out of your own encrypted data with no obvious cause.

Here's the deal: your TPM stores encrypted blobs tied to its own unique keys. When Windows or BitLocker sealed data to that TPM, it used a specific key hierarchy. If the TPM is cleared, replaced, or its firmware is updated in a way that resets the endorsement key, the blob becomes invalid. The TPM literally cannot decrypt it anymore. This is by design—it's a security feature, not a bug.

What Actually Causes TPM_E_NOTSEALED_BLOB? (0x80280013)

This error means the TPM received a request to unseal a blob (an encrypted piece of data) but the blob wasn't created by this TPM or its current key set. The most common triggers:

You cleared the TPM from tpm.msc or the BIOS (maybe to fix another issue), which wiped its storage root key.
You replaced the motherboard or the TPM chip itself.
A BIOS/UEFI update reset the TPM or changed its firmware version in a way that invalidated existing blobs.
You cloned a system drive to a new machine where the TPM is different.
Windows automatically cleared the TPM after too many failed logins (rare, but possible with BitLocker).

The TPM holds a Storage Root Key (SRK). All sealed blobs are children of that SRK. If the SRK changes—because the TPM was cleared or replaced—all previous blobs are orphaned. That's exactly what 0x80280013 is telling you.

How to Fix TPM_E_NOTSEALED_BLOB

You'll need to clear the TPM and let Windows re-initialize it. This does not delete your data, but it does invalidate any keys sealed to the old TPM. If BitLocker is involved, have your recovery key ready.

Back up your BitLocker recovery key. If your system drive is encrypted, go to manage-bde -protectors -get C: in an admin Command Prompt. Write down the numerical password. You'll need it after clearing the TPM.
Clear the TPM. Open tpm.msc (press Win+R, type it). In the right pane, click Clear TPM. You'll be asked to restart. If the option is greyed out, your TPM might be owned by the OS—use PowerShell as admin:
```
Clear-Tpm
```
Then reboot.
Re-initialize the TPM. After the reboot, Windows should automatically take ownership and create a new SRK. Check with tpm.msc—status should read "The TPM is ready for use." If it says "TPM is not initialized," run
```
Initialize-Tpm
```
in an elevated PowerShell window.
Re-seal your data. For BitLocker, you'll need to suspend and resume protection to re-seal the volume master key to the new TPM. Run
```
manage-bde -protectors -disable C: -rebootcount 1
```
then reboot. After that, re-enable with
```
manage-bde -protectors -enable C:
```
.
Fix Windows Hello. If you're using PIN or biometrics, they'll break after a TPM clear. Go to Settings > Accounts > Sign-in options. Remove your PIN and set it up again. This re-creates the key containers tied to the new TPM.

On some systems, especially older Dell OptiPlex or Lenovo ThinkPads with firmware TPMs (Intel PTT or AMD fTPM), a BIOS update can cause this even without a manual clear. In that case, the fix is the same: clear and re-provision.

If It Still Fails After Clearing the TPM

If you're still seeing 0x80280013 after a clear and re-initialize, check these:

TPM firmware version. Run Get-Tpm in PowerShell. If ManufacturerVersion is blank or shows "unknown," your TPM firmware might be corrupt. Check your motherboard vendor for a TPM firmware update—some Intel systems had a bug where the TPM would lock up after sleep.
BIOS/UEFI settings. Make sure TPM is enabled and set to the correct mode (PTT for Intel, fTPM for AMD, or discrete TPM if you have a module). Disable "TPM Clear" in BIOS if it's set to clear on every boot—yes, that's a real setting on some ASUS boards.
Group Policy. If you're on a domain, a policy might be blocking TPM initialization. Check Computer Configuration > Administrative Templates > System > Trusted Platform Module Services. The "Turn on TPM backup to Active Directory Domain Services" policy can interfere if misconfigured.
Hardware failure. If Get-Tpm shows TpmPresent: True but TpmReady: False and clearing doesn't help, the TPM chip itself may be dead. On discrete TPMs (the little 14-pin modules), reseat it. On firmware TPMs, a BIOS reflash might revive it—or it's a motherboard RMA.

One more thing: if you're getting this error during Windows Update, especially a feature update like 22H2 or 23H2, it's often because the update is trying to re-seal keys to the TPM but the TPM has a stale blob from a previous failed attempt. Clearing the TPM and retrying the update usually works.

Don't waste time with third-party "TPM repair" tools. They can't recreate a lost SRK. The only real fix is to clear and re-provision, then re-seal your data.