TPM_E_SHA_ERROR (0X8028001B) – Fix Guide

You're trying to set up BitLocker, or maybe you're running a Windows Update, and boom – error 0X8028001B. The full message says TPM_E_SHA_ERROR. It's not a hardware failure, don't panic. The TPM chip itself is fine. This error means Windows can't talk to the TPM the way it expects. Let's fix it.

1. TPM Driver is Outdated or Corrupted (Most Common)

Nine times out of ten, this error pops up because the TPM driver in Windows is old or got messed up by a bad update. The fix is to reinstall the driver. Here's how, step by step:

1. Press Windows Key + X and click Device Manager.
2. Find Security devices and expand it. You'll see something like Trusted Platform Module 2.0.
3. Right-click that TPM entry and choose Uninstall device. A warning box will pop up. Don't check the box that says "Delete the driver software for this device". Just click Uninstall.
4. After the uninstall finishes, restart your computer. Windows will automatically reinstall the correct driver on boot.
5. Check if the error is gone. Open Command Prompt as admin and type: wmic tpm get IsEnabled_InitialValue. If it shows "TRUE" you're good.

Expected outcome: After the restart, you should see the TPM listed again in Device Manager with no yellow warning triangles. The error 0X8028001B goes away.

If that didn't fix it, move to the next cause.

2. Wrong TPM Firmware Version in BIOS

Some motherboards let you choose between TPM 1.2 and TPM 2.0. Error 0X8028001B sometimes shows up when you're on TPM 1.2 but Windows expects 2.0. This happens most often on custom-built PCs or older business laptops that got upgraded to Windows 11.

Real-world trigger: You just got a new Windows 11 update, and after restart, the TPM error appears. You check the BIOS and it's set to TPM 1.2.

1. Restart your PC and press the key to enter BIOS setup. Usually it's Del, F2, or F10 – watch for the message at boot.
2. Look for a section called Security, Advanced, or Trusted Computing. Exact name varies by manufacturer.
3. Find the TPM setting. It might say TPM Device Selection, TPM Firmware, or Security Chip.
4. Change it from TPM 1.2 to TPM 2.0. If you only see Discrete TPM and Firmware TPM, pick Firmware TPM.
5. Save and exit. The computer will restart.
6. Boot back to Windows and test again.

Expected outcome: Windows should now detect TPM 2.0. Run tpm.msc from the Run dialog (Windows Key + R). The status should say "The TPM is ready for use".

Still getting the error? One more thing to check.

3. BIOS Settings Have TPM Disabled or Cleared

This one's trickier. Some motherboards have a setting that lets you "Clear TPM" or "Reset TPM" from the BIOS. If someone accidentally did that, or if a BIOS update reset things, the TPM state gets messed up. Error 0X8028001B can show up because Windows sees a blank TPM and doesn't know what to do with it.

1. Enter BIOS again (same key as before at startup).
2. Go to Security or Trusted Computing section.
3. Make sure TPM State is set to Enabled. Some boards have TPM Support – enable that.
4. Look for Clear TPM or Reset TPM. If you see it, don't use it unless you're sure. Clearing the TPM will break BitLocker and require recovery keys. Only try this as a last resort.
5. Instead, look for TPM Activation Policy or TPM Select. Set it to Activate if it's on Deactivate or No.
6. Save and exit. Boot into Windows.
7. Open PowerShell as admin and run: Get-Tpm. Check that TpmReady shows True. If it's False, run Initialize-Tpm.

Expected outcome: After these steps, the Get-Tpm command should show all fields as True. The 0X8028001B error won't come back.

I've seen this exact error on Dell OptiPlex 7080 machines after a BIOS update from Dell's support site. The update reset TPM to disabled. Re-enabling it fixed everything.

Quick-Reference Summary

Try the driver fix first – it's the fastest and fixes the most cases. If that doesn't work, the BIOS settings are your next stop. Don't clear the TPM unless you have your BitLocker recovery key saved somewhere safe.