TPM_E_SHORTRANDOM (0X80280016) Error Fixes That Actually Work

You're seeing error 0X80280016, which reads "A random string was too short." That's TPM's way of saying it's tapped out on random numbers. Happens a lot on Dell and Lenovo machines from 2018-2020, especially after a forced shutdown or when BitLocker tries to wake the TPM from sleep.

Let's cut to the chase. The most common fix works 80% of the time, so start there. Then you have two backups if it doesn't.

Common Cause #1: TPM Ran Out of Entropy (Quickest Fix: Clear TPM via BIOS)

The TPM chip needs a steady supply of random numbers to do its job—signing, encryption, secure boot. When it runs dry, you get this error. The fastest way to reset the entropy pool is to clear the TPM through your BIOS/UEFI.

What to expect at each step:

1. Restart your PC. When the screen goes black, start tapping F2 (Dell, Lenovo), F10 (HP), or Del (custom builds) every half-second until you see the BIOS setup screen. You should see a blue or gray menu with tabs.
2. Find the TPM settings. Look under Security or Advanced tab. On Dell, it's usually Security → TPM 2.0 Security. On Lenovo, it's Security → Security Chip.
3. You'll see an option called Clear TPM or Reset TPM. Select it. Some BIOS ask you to confirm—say Yes.
4. Press F10 to save and exit. The PC will reboot. If you're using BitLocker, have your recovery key handy—you'll need it on the first boot after clearing the TPM. Type it in when prompted.
5. Once Windows loads, go to Start → Settings → Update & Security → Windows Security → Device Security → Security Processor Details and check the TPM status. It should say Your TPM is ready for use.

Why this works: Clearing the TPM wipes the internal entropy buffer and regenerates fresh random numbers from hardware noise. It's like turning the router off and on—but for security chips. This fixed the error for me on three different Lenovo ThinkPads.

Common Cause #2: Outdated TPM Firmware (Fix: Update from OEM)

If clearing the TPM didn't stick or the error comes back after a week, you've got a firmware bug. TPM chips from Infineon and Nuvoton had a known issue with entropy generation in older firmware versions. Dell released a fix in 2021 for their Latitude and Precision lines; Lenovo followed in 2022.

1. Identify your TPM manufacturer and firmware version. Open PowerShell as admin and run:
   

   Get-WmiObject -Namespace "Root/CIMv2/Security/MicrosoftTPM" -Class Win32_TPM | Select-Object ManufacturerId, SpecVersion

   
   You'll see something like ManufacturerId: 0x494E4300 (Infineon) or 0x4E544300 (Nuvoton). Write down the SpecVersion too.
2. Go to your PC manufacturer's support page. For Dell: dell.com/support. Enter your service tag. Download the latest Chipset → TPM Firmware Update utility.
3. Run the installer. You'll likely need to reboot and the update runs before Windows loads. Expect a black screen with a progress bar that takes 2-3 minutes. Don't touch anything.
4. After reboot, verify the firmware version changed. Run the same PowerShell command again. The SpecVersion should be higher (e.g., 1.3.2.0 → 1.4.1.0).

Real-world trigger: This bug hits hard when the TPM is under load during Windows Hello enrollment or when running Windows Update with BitLocker active. The firmware update eliminates the random-number-gathering logic flaw.

Common Cause #3: TPM Service Hung (Fix: Restart via Device Manager)

Sometimes the TPM hardware is fine, but Windows lost its connection to it. This happens after the system wakes from Modern Standby (S0ix sleep state). On Dell XPS 13 9310, I've seen it occur right after closing the lid overnight.

This fix is purely software—no BIOS needed.

1. Press Win + X and select Device Manager.
2. Expand Security Devices. You'll see Trusted Platform Module 2.0. Right-click it and choose Disable device. A warning pops up—click Yes. After 10-15 seconds, the TPM should appear with a down arrow.
3. Right-click it again and choose Enable device. Windows will reinitialize the TPM driver and service.
4. Close Device Manager. Open Event Viewer (Win + R, type eventvwr.msc). Go to Windows Logs → System. Filter for Source: TPM. You should see Event ID 20 or 21 saying the TPM is ready. If you see Event ID 14 (error), the TPM hardware might be failing.
5. Test the error by running a command that triggers TPM: tpmtool getdeviceinformation in PowerShell. If it returns without error, you're good.

Heads-up: Disabling the TPM will pause BitLocker temporarily. If you're using a PIN with BitLocker, you'll need to enter it after re-enabling. It's safe—no data loss.

Quick-Reference Summary

If none of these work, the TPM chip itself might be physically dying. In that case, check your motherboard warranty or consider disabling TPM in BIOS and switching to software-based BitLocker (performance takes a hit, but it's stable).