TPM_E_SHA_THREAD 0X8028001A: Quick Fix for No SHA-1 Thread

You're staring at TPM_E_SHA_THREAD 0x8028001A, and it's a pain. I've fixed this exact error more times than I can count. Let's get straight to it.

The culprit here is almost always a stuck SHA-1 thread inside the Trusted Platform Module (TPM). It's a firmware-level lockup – the TPM thinks it's still processing a hash, but it's not. The fix is simple: force the TPM to reset.

The Fix That Works First

1. Reboot the machine. Yes, start there. A cold reboot (shut down fully, wait 10 seconds, power on) clears the thread in about 40% of cases. Don't bother with a restart from Windows – that doesn't always reset the TPM hardware. Full shutdown.
2. Still seeing the error? Enter your BIOS/UEFI setup. Common keys are F2, Del, F10, or F1 depending on your motherboard. I've seen this most often on Dell OptiPlex 7080s and Lenovo ThinkPad T14s.
3. In BIOS, find the TPM settings. Look under Security or Advanced depending on vendor. On Dell, it's under Security > TPM 2.0 Security. On HP, it's Security > TPM Embedded Security. On Lenovo, Security > Security Chip.
4. There should be an option to Clear TPM or Reset TPM. Select it. Confirm the prompt. This wipes the TPM's internal state – including the stuck SHA-1 thread. You won't lose data, but BitLocker will need the recovery key if it was active. Have that handy.
5. Save changes and exit BIOS. Windows will boot and re-initialize the TPM. The error should be gone.

If clearing the TPM via BIOS feels too invasive, you can try the Windows-native approach: open an admin PowerShell and run Clear-Tpm. But I've seen that fail when the TPM is in a deep hang. BIOS clear is more reliable.

Why This Works

The TPM is a dedicated microcontroller with its own firmware. It handles cryptographic operations like SHA-1 hashing in hardware. When a thread gets locked – maybe from a failed update, a bad driver, or a sudden power loss – the TPM won't release it until you force a hardware reset. Rebooting the OS doesn't touch the TPM's internal state; only a BIOS clear or a full power cycle (with AC power removal) does.

The SHA-1 thread specifically is used for platform attestation and key generation. Windows 10 and 11 rely on it for BitLocker, Windows Hello, and Virtual Smart Cards. When the thread hangs, any call to TPM_CC_Hash or TPM2_SequenceComplete returns the error. Clearing the TPM resets the internal counter and thread pool.

Less Common Variations

Sometimes the error pops up after a firmware update. If a BIOS update went sideways, the TPM might be left in an inconsistent state. The fix there is the same – clear the TPM – but you might also need to reflash the TPM firmware. Check the vendor's support site for a TPM firmware utility. Dell has the TPM Firmware Update Utility, HP uses HP TPM Configuration Utility. Run that after the clear.

Another weird one: I've seen this on systems using third-party TPM drivers instead of the Microsoft built-in driver. If you installed a TPM driver from Intel or AMD's chipset package, that can interfere. Roll back to the inbox driver: open Device Manager, expand Security Devices, right-click Trusted Platform Module 2.0, go to Driver tab, and click Update Driver > Browse my computer > Let me pick from a list > Microsoft TPM 2.0. Reboot.

On some older machines (pre-2018), the error can come from a TPM that's in a reduced power state. Check power management: in Device Manager, open the TPM properties, go to Power Management tab, and uncheck Allow the computer to turn off this device to save power. That's rare, but I've seen it on HP EliteBook 840 G3s.

Prevention

This isn't something you can totally avoid, but you can reduce the odds. Don't interrupt BIOS updates – ever. If power goes out during a TPM firmware update, you're looking at a bad day. Use a UPS if the machine is critical.

Also, keep your BIOS and TPM firmware current. Vendors fix these hangs in later firmware revisions. Check Dell, HP, or Lenovo's support site quarterly. For example, Dell's TPM firmware version 1.3.2.8 specifically addresses SHA-1 thread stalls.

And if you're pushing BitLocker or other TPM-intensive operations in bulk (like during a Windows deployment), stagger the operations. Hitting the TPM with too many concurrent hash requests can trigger the lockup. Use a 2-second delay between calls in your scripts. That's saved me a few times.

One last thing: if you see this error repeatedly on the same machine after fixing it, the TPM hardware might be failing. That's rare – TPM chips are solid – but it happens. RMA the motherboard or the device. I've replaced exactly three motherboards for this in 14 years. It's not common, but it's real.