Fix NTE_BAD_DATA (0X80090005) Error on Windows 10/11

You're staring at that NTE_BAD_DATA (0X80090005) error and you're probably ready to throw your computer out the window. I've been there. This error usually pops up when Windows tries to use a TPM (Trusted Platform Module) key that's corrupt or misconfigured. It can happen after a Windows update, a BIOS change, or just out of nowhere when you're trying to sign in with a PIN or open BitLocker.

Let's fix it. I'll show you the method that works 90% of the time — clearing the TPM keys from Windows itself. No BIOS fiddling required.

Step 1: Clear the TPM Keys Using Windows Security

1. Press Windows Key + R to open the Run box.
2. Type tpm.msc and hit Enter. This opens the TPM Management console.
3. Look at the status. If it says "The TPM is ready for use," you're in the right place. If it says "Compatible TPM cannot be found," skip to the registry fix below.
4. In the right-hand pane, click Clear TPM. You'll see a warning that clearing the TPM resets BitLocker, Windows Hello, and any app that uses TPM keys.
5. A window pops up asking you to restart the computer. Click Restart. Don't worry — it won't reboot immediately. Windows will prepare the TPM reset first.
6. After the restart, your screen will go black for a few seconds. You'll see a message saying "Press a key to clear the TPM." Press Spacebar or Enter exactly when prompted. Miss it, and Windows boots normally without clearing. If you miss it, just try again.
7. Once you press the key, the TPM clears. Windows boots up like it's new. You'll need to set up your PIN, fingerprint, or BitLocker again.

Expected outcome: After the reboot, the 0x80090005 error should be gone. Try opening whatever caused the error — a PIN login, BitLocker, or a certificate operation. It should work now.

Step 2: If Clearing TPM Doesn't Work (Registry Fix)

Sometimes the TPM console won't let you clear the keys. Or maybe you're on a work computer where IT blocked TPM management. Here's another way.

1. Press Windows Key + R, type regedit, and hit Enter.
2. Go to this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\TPM

3. If you don't see the TPM folder, right-click Microsoft, choose New > Key, and name it TPM.
4. Right-click in the right pane, choose New > DWORD (32-bit) Value. Name it OSManagedAuthLevel.
5. Double-click that new value and set it to 5. Click OK.
6. Close Registry Editor and restart your computer.

Expected outcome: After the reboot, Windows will manage the TPM authorization level differently. This often fixes the bad data error without clearing the entire TPM. Your PIN and BitLocker should still work — unlike the full clear method above.

Why This Works

The NTE_BAD_DATA error means Windows asked the TPM to use a key, but the TPM said "that key doesn't look right." It's like trying to open a lock with a bent key. The TPM stores keys in a protected area, and sometimes a Windows update or a power failure corrupts the metadata around those keys.

Clearing the TPM wipes those keys entirely. Windows then creates fresh keys on next boot. The registry fix tells Windows to use a different authorization method (level 5 means OS-managed authorization instead of TPM-managed). This bypasses the corruption without nuking your keys.

Less Common Variations of the Same Issue

1. BitLocker Recovery with 0x80090005

If you see this error when entering a BitLocker recovery key, the recovery key itself might be corrupt. Try entering it again slowly. If it fails, use a different recovery key (you should have saved one to your Microsoft account or printed it). If you have no backup, you'll need to format the drive — that's the hard truth.

2. Windows Hello PIN Error

Sometimes the error shows when setting up a PIN. In that case, don't clear the TPM. Instead, go to Settings > Accounts > Sign-in options, remove your PIN, restart, and set up a new PIN. This re-creates the PIN data without touching the TPM.

3. Certificate Errors in Remote Desktop or VPN

If you get 0x80090005 when connecting to a VPN or using Remote Desktop, the problem might be a corrupt certificate store. Open Command Prompt as admin and run:

certutil -store my

If you see weird characters or empty lines, the store is corrupt. Try:

certutil -repairstore my ""

This repairs the personal certificate store. Reboot after.

How to Prevent This Error in the Future

You can't stop every Windows update from messing with TPM keys, but you can reduce the odds.

• Never force-shut down your PC during a Windows update or a BIOS update. Power loss during TPM operations corrupts keys.
• Keep BIOS/UEFI firmware up to date — but wait a month after release. Let others find the bugs. TPM firmware bugs cause this error.
• Back up BitLocker recovery keys to your Microsoft account and a USB drive. If the error hits, you can still access your data.
• Disable TPM auto-provisioning in Group Policy if you're a power user. This stops Windows from automatically taking ownership of the TPM, which sometimes creates bad data. Go to gpedit.msc > Computer Configuration > Administrative Templates > System > Trusted Platform Module Services. Set "Turn on TPM backup to Active Directory Domain Services" to Disabled.
• Run a disk check monthly. Corrupted files on the system drive can cause all kinds of weird errors, including 0x80090005. Open Command Prompt as admin and type chkdsk /f C:. Say Yes to schedule it on next reboot, then restart.

That's it. You should be back to normal now. If none of this worked, you might have a failing TPM chip — in which case you'll need a motherboard replacement. But that's rare. Try the fixes above first.