NTE_BAD_UID 0x80090001 on Windows — TPM User ID Mismatch Fix

What's Actually Happening Here

The 0x80090001 error — NTE_BAD_UID — means the Trusted Platform Module (TPM) on your motherboard is rejecting the user identity you're giving it. This usually shows up when you try to unlock BitLocker, sign in with Windows Hello (PIN, fingerprint, face), or use a certificate stored in the TPM. The TPM keeps a list of user IDs tied to keys. If that list gets corrupted or the hardware changes (like swapping a hard drive to a different PC), the TPM says: "I don't know who you are. Bad UID."

I've seen this most often after a motherboard swap, a BIOS update that resets TPM, or when Windows itself corrupts its own credential store. Don't waste time reinstalling Windows — the fix is targeted.

Most Common Cause: TPM Ownership Corrupted (Fix First)

Nine times out of ten, the TPM owner authorization value (the password that controls who can manage the TPM) is missing or wrong. Windows sets this during setup. If the TPM is cleared or the ownership got lost, you get 0x80090001 on any TPM operation.

Fix: Clear and Reinitialize the TPM

1. Backup BitLocker recovery keys first. If you have BitLocker enabled, get your recovery key from your Microsoft account (https://account.microsoft.com/devices/recoverykey) or from Active Directory. Write it down. You will need it after the TPM is cleared.
2. Press Win + R, type tpm.msc, hit Enter. The TPM Management console opens.
3. Look at the status in the bottom panel. It should say The TPM is ready for use. If it says No TPM detected, your BIOS has it disabled — that's a different problem.
4. In the right-hand Actions pane, click Clear TPM. You'll need to restart the PC. The TPM will be reset to factory defaults.
5. After restart, Windows will re-initialize the TPM automatically. BitLocker will ask for your recovery key — enter the one you saved.
6. Go back to tpm.msc and check it shows The TPM is ready for use. The error 0x80090001 should be gone.

Why this works: Clearing the TPM wipes all stored user IDs and keys. Windows then creates fresh ones during the next boot. The error came from an old UID that didn't match anymore — now it's gone.

Second Most Common Cause: Corrupted Windows Hello or Credential Store

Sometimes the TPM itself is fine, but Windows has a broken PIN, fingerprint data, or certificate in its own credential manager. This happens after a Windows update (especially Windows 11 22H2) or if you force-closed the setup process.

Fix: Delete and Recreate Windows Hello Credentials

1. Open Settings > Accounts > Sign-in options.
2. Under Windows Hello PIN, click Remove. It'll ask for your password. Do it.
3. Restart your PC.
4. Go back to the same screen and set up a new PIN. Don't use the same PIN — use a different one (Windows stores a hash, not the PIN itself, but a different value forces a fresh key pair).
5. If you also use fingerprint or face, remove those too (one at a time), restart, then re-enroll them.

Why step 3 matters: Restarting clears the cached state in the TPM driver. If you skip the restart, Windows might reuse the old corrupted data. I learned that the hard way after wasting an hour.

Alternative Fix: Clear the Certificate Store

If the error appears when you're accessing encrypted files or using a smart card:

1. Open an admin command prompt (Win + X, Terminal (Admin)).
2. Run: certutil -store my to list personal certificates.
3. If you see any certificates with NTE_BAD_UID in their status, delete them: certutil -delstore my "<serialnumber>".
4. Re-import the certificate from a backup. Or request a new one from your CA.

Third Most Common Cause: TPM Disabled or Misconfigured in BIOS/UEFI

Less common, but I've seen it: the TPM is physically present but disabled in the firmware. Windows sees the TMP device but can't talk to it properly, throwing 0x80090001.

Fix: Enable TPM in BIOS/UEFI

1. Restart your PC. During boot, press Del, F2, F10, or Esc (depends on motherboard).
2. Look for Security or Trusted Computing section.
3. Set TPM Device to Enabled (or Firmware TPM for AMD CPUs — it's fTPM).
4. Set TPM State to Enabled.
5. Save and exit.
6. Boot into Windows, go to tpm.msc and confirm it's ready.

fTPM (AMD) and PTT (Intel) are firmware-based TPMs. They work fine, but if you recently updated your BIOS, the setting might have defaulted to disabled. Always check after a BIOS update.

Quick-Reference Summary Table

If none of these work, you might have a failing TPM chip. On Intel 12th/13th gen systems with Raptor Lake, there's a known bug where fTPM stutters or fails. In that case, disable fTPM and use a software-based BitLocker (Group Policy: Require additional authentication at startup → turn off TPM). Not ideal, but it works until you replace the motherboard.