Fix TPM_E_KEYNOTFOUND (0X8028000D) on Windows

Quick Answer for Advanced Users

Run tpm.msc → click "Clear TPM" → reboot → re-provision via tpm.msc → re-enable BitLocker or re-attach keys. If BitLocker is active, you MUST have the recovery key first.

What's Going On Here

I know this error is infuriating. You're trying to use a TPM-dependent feature—BitLocker, Windows Hello, maybe a VPN client—and Windows throws TPM_E_KEYNOTFOUND (0X8028000D). The TPM chip is working, but the key handle it points to is either deleted, corrupt, or belongs to a different machine state.

This tripped me up the first time too. The most common trigger is a BIOS/UEFI update that resets TPM ownership. Another big one: reinstalling Windows without properly backing up TPM keys. The TPM holds its own internal memory—when that memory gets wiped or reassigned, existing key handles become dead pointers.

Fix It: Clear and Re-Provision the TPM

WARNING: If you use BitLocker, have your recovery key ready before doing this. You can find it in your Microsoft account (aka.ms/recoverykey) or printed out. Without it, you lose access to the drive.

Open TPM Management
Press Win + R, type tpm.msc, hit Enter. This opens the Trusted Platform Module management console.
Check TPM Status
Look at the bottom of the window. If it says "The TPM is ready for use," you still need to clear it. If it says "No TPM found," you have a hardware problem—check BIOS.
Clear the TPM
Under "Actions" on the right, click "Clear TPM." You'll see a scary warning about BitLocker—pay attention. Confirm and the system reboots immediately.
Re-Provision After Reboot
When Windows comes back, open tpm.msc again. Click "Prepare the TPM" or "Provision TPM" (Windows 10 and 11 call it different things). Accept the default settings. That's it—the key store is fresh.
Re-enable BitLocker or Attach Keys
If you're using BitLocker, go to Control Panel → BitLocker Drive Encryption, click "Turn on BitLocker" again. It'll write a new key into the cleared TPM. For other apps (VPNs, Hello), just delete and re-add your credentials—they'll create new keys.

Alternative Fixes If the Main One Fails

Clearing the TPM fixes 90% of 0X8028000D cases. But if that didn't stick, try these:

1. Reset TPM via Device Manager

Open Device Manager, expand "Security devices," right-click "Trusted Platform Module 2.0" (or your version), select "Uninstall device." Check "Delete the driver software for this device"—don't worry, Windows re-pulls it. Restart, then go to tpm.msc and provision fresh. I've seen this work on Dell Precision 5550s after BIOS updates.

2. Use PowerShell to Force Clear

Open PowerShell as admin. Run Clear-Tpm. If it errors out, your BIOS might block clearing. In that case, reboot into BIOS (usually F2 or Del), find "TPM security settings" or "AMD fTPM" (for Ryzen chips), set it to "Clear" or "Reset to factory defaults." Save and exit.

3. Revert BIOS Update

If the error started right after a BIOS update, flash back to the previous version. I've seen ASUS boards (Z690, X570) break TPM key storage with specific firmware versions. Check the manufacturer's support page for your board—if others report the same, it's a known bug.

Prevention Tips

To stop this from happening again:

Back up BitLocker recovery keys now. Save them in your Microsoft account or print them. You'll thank yourself later.
Before a BIOS update, temporarily disable BitLocker (Control Panel → BitLocker → "Suspend protection"). Re-enable it after the update. This stops the TPM from getting confused.
Don't mess with TPM settings in BIOS unless you know what you're doing. Randomly toggling "TPM Enable/Disable" or "fTPM switch" corrupts key stores.
If you dual-boot (Windows + Linux), be careful with Linux tools that talk to TPM. Some distros (e.g., Ubuntu 22.04 with tpm2-tools) can accidentally delete Windows keys. Always test in a VM first.

That's it. The error is ugly, but the fix is straightforward. You'll be back to normal in under 10 minutes—as long as you didn't skip the backup step. Good luck.