A BitLocker, Windows Hello, TPM ownership, or firmware error can point to damaged TPM data. Clearing it may fix the error, but first verify your BitLocker recovery key.
What Is the TPM?
The Trusted Platform Module (TPM) is a security processor in your PC or its firmware. Windows uses it to protect encryption keys, Windows Hello credentials, startup data, virtual smart cards, and other secrets.
Clearing the TPM removes its stored keys and ownership data. It doesn’t delete your personal files. However, you may lose access to encrypted data without its recovery key.
Clear the TPM only when a documented fix calls for it, such as:
- Persistent TPM ownership or setup errors
- Windows Hello failures that remain after you reset the PIN
- BitLocker errors caused by an invalid TPM state
- A firmware update failure that Microsoft or the PC maker links to the TPM
- Preparing a personal PC for a clean security setup
Don’t clear it to improve performance or fix an unrelated Windows error. A temporary PIN problem also doesn’t need a TPM reset. On a work or school PC, get IT approval first. Company certificates and credentials may depend on the current TPM keys.
Prerequisites
Make sure you have:
- A Windows 11 PC with a working TPM
- An administrator account
- The Windows account password or another sign-in method besides the PIN
- A verified BitLocker recovery key if BitLocker or Device Encryption is enabled
- AC power connected to a laptop
- Important files backed up
- Approval from your IT administrator if the PC is managed
Warning: Stop if BitLocker is enabled and you can’t find its recovery key. Clearing the TPM could lock you out of Windows or another encrypted drive.
Step-by-Step Guide
Fix #1: Verify and Back Up the BitLocker Recovery Key
Do this before you clear the TPM. You can’t safely skip it.
- Press
Windows + R.
- Enter
control /name Microsoft.BitLockerDriveEncryption, then select OK.
control /name Microsoft.BitLockerDriveEncryption- Find the Windows drive, usually C:, and check whether BitLocker on appears.
- Select Back up your recovery key if the option is available.
- Save the key somewhere you can reach if the PC won’t start. Good options include:
– Your personal Microsoft account – A USB drive kept separate from the PC – A printed copy stored securely – Your organization’s Microsoft Entra ID or Active Directory account, when managed by IT
- If you saved it to a Microsoft account, open https://account.microsoft.com/devices/recoverykey on another device. Sign in with the same account.
- Match the listed recovery-key ID to the PC or drive. Don’t rely only on the device name.
- Keep the recovery key nearby during the restart.
Expected result: You have a readable 48-digit BitLocker recovery key stored outside the computer. Stop here if you can’t verify one.
Fix #2: Clear the TPM Through the TPM Management Console
The TPM Management Console is usually the best option. It shows the current status and clear command in one window.
- Press
Windows + R.
- Enter
tpm.msc, then select OK.
tpm.msc
- Approve the User Account Control prompt if it appears.
- Read the Status section. A working TPM usually reports, “The TPM is ready for use.”
- Under TPM Manufacturer Information, confirm that Specification Version shows
2.0.
- Select Clear TPM in the Actions pane.
- Read the warning and confirm that your recovery key is available. Select the option to restart and clear the TPM.
- Read the firmware message during startup. Your PC may ask you to press a key to approve or reject the reset.
- Approve it only if the prompt mentions clearing the TPM and you have the recovery key. The wording and required key vary by PC maker.
- Let Windows restart without disconnecting the power.
Expected result: Windows starts after the firmware clears the stored TPM keys. You may see a BitLocker recovery screen or Windows Hello setup prompt.
Fix #3: Clear the TPM Through Windows Security
Windows Security offers the same reset in a familiar window. Use it if you’d rather skip the management console.
- Open Start, search for Windows Security, and open the app.
- Select Device security.
- Under Security processor, select Security processor details.
- Select Security processor troubleshooting.
- Review any TPM error shown.
- Select Clear TPM.
- Confirm the warning after checking that your BitLocker recovery key is available.
- Restart the PC when Windows asks.
- Approve the TPM clear during startup if the firmware asks for confirmation.
Expected result: The PC restarts, clears the TPM, and returns to Windows. Windows then sets up the TPM again.
Fix #4: Clear the TPM With Administrator PowerShell
Use PowerShell if the graphical controls are missing. You must run it as an administrator because the command changes TPM ownership and stored security data.
- Right-click Start.
- Select Terminal (Admin).
- Select Yes in the User Account Control dialog.
- Run this command to check the TPM’s current state:
Get-Tpm- Confirm that
TpmPresentisTrue. Also checkTpmReady,TpmEnabled, andTpmActivated.
- Run the clearing command:
Clear-Tpm
- Follow the instructions in Terminal. Some PCs schedule the reset for the next restart.
- Restart the PC if asked.
- Approve the firmware prompt only after checking that you have the BitLocker recovery key.
Expected result: PowerShell starts the TPM reset or says physical confirmation is required. Windows should set up the TPM again after restarting.
Fix #5: Restore Windows Hello and Verify TPM Provisioning
Clearing the TPM removes the private key that protected your Windows Hello PIN. The old PIN may stop working, but you can sign in with your account password.
- At the sign-in screen, select Sign-in options.
- Sign in with your account password if Windows rejects the PIN.
- Select I forgot my PIN if Windows offers it.
- Complete the account check requested by Windows.
- Create and confirm a new PIN.
- After reaching the desktop, open Settings > Accounts > Sign-in options.
- Expand PIN (Windows Hello) and confirm that the new PIN is available.
- Press
Windows + R, entertpm.msc, and select OK.
- Confirm that the status reads, “The TPM is ready for use.”
- Open Windows Security > Device security > Security processor details. Check that the TPM information appears normally.
Expected result: Windows has taken ownership of the TPM and set it up again. Your new Windows Hello PIN works.
Fix #6: Check BitLocker After the Reset
Clearing the TPM usually doesn’t require you to decrypt and encrypt the drive again. Windows can link BitLocker’s key protector to the reset TPM. The final state depends on your BitLocker settings.
- If Windows shows a BitLocker recovery screen, find the matching recovery-key ID.
- Enter the matching 48-digit recovery key.
- After signing in, open Start, search for Manage BitLocker, and open it.
- Check the Windows drive’s status.
- If protection is suspended, select Resume protection.
- Open Terminal (Admin) and run:
manage-bde -status C:- Confirm that Conversion Status says the drive is fully encrypted. Protection Status should say protection is on.
Expected result: The drive stays encrypted, and BitLocker protection is active. You won’t need full encryption again unless you decrypted the drive or removed its protectors.
Configuration After Clearing
Windows normally sets up the TPM during or after the first successful restart. You don’t need to take ownership by hand on a personal Windows 11 PC.
Check these settings once the computer is stable:
- Open Settings > Privacy & security > Device encryption on supported devices. On editions with full BitLocker controls, open Manage BitLocker.
- Confirm that encryption is on and that you still have a current recovery key.
- Open Settings > Accounts > Sign-in options and test the new PIN.
- Open Settings > System > About. Note the device name if you need to match it to a recovery key in your Microsoft account.
- Install pending updates from Settings > Windows Update. Don’t keep clearing the TPM if a firmware update still fails.
These TPM steps apply only to Windows PCs. iOS doesn’t provide access to a Windows TPM or a Clear-Tpm command. macOS uses different security hardware, including the Secure Enclave.
Tips and Troubleshooting
Fix #7: Restore an Unavailable or Greyed-Out Clear TPM Control
A missing or greyed-out button usually points to account rights, firmware access, or company policy. Check those before changing BIOS or UEFI settings.
- Sign in with an administrator account.
- Run
tpm.mscand check whether Windows finds a compatible TPM.
- If the console says no compatible TPM can be found, restart the PC. Check for Windows updates and firmware updates approved by the PC maker.
- Open Windows Security > Device security and confirm that Security processor appears.
- Check Settings > Accounts > Access work or school to see if an organization manages the PC.
- Contact your IT administrator if a policy blocks TPM changes.
- Don’t change TPM firmware settings with generic instructions. Labels and confirmation keys vary by PC maker.
A missing control can mean you lack administrator rights. The TPM may also be disabled, blocked by policy, or waiting for another approved process.
Fix #8: Resolve a TPM Ownership Conflict
Windows should reclaim the TPM after one restart. If it doesn’t, start the setup from an administrator Terminal.
- Restart Windows once after clearing the TPM.
- Run
tpm.msc.
- Check whether the TPM reports that it is ready for use.
- Run the following commands in Terminal (Admin):
Get-Tpm
Initialize-Tpm- Restart if PowerShell asks.
- If the conflict returns on a managed PC, stop and contact IT. Device-management software may be restoring company ownership settings.
Fix #9: Handle a TPM-Related Firmware Update Failure
One failed firmware update doesn’t justify another TPM reset. Record the exact error first, then check the instructions for your PC model.
- Record the exact update name and error code from Settings > Windows Update > Update history.
- Confirm that BitLocker protection is active and its recovery key is backed up.
- Restart the PC and retry the update once.
- Check the PC maker’s support page for that exact model and update.
- Follow the maker’s model-specific instructions only if they call for suspending BitLocker or clearing the TPM.
- Stop clearing the TPM if the same update fails again. Repeated resets won’t repair a bad firmware package or a failing security processor.
A firmware update failure alone isn’t a reason to clear the TPM. Reset it only when the update instructions or support team names the stored TPM state as the cause.
Fix #10: Stop Safely When You Do Not Have a Recovery Key
No verified recovery key means no TPM reset. Finding the key now is far easier than losing an encrypted drive.
- Don’t clear the TPM.
- Check the Microsoft account recovery-key page from another device.
- Ask your IT administrator to check Microsoft Entra ID or Active Directory if the PC is managed.
- Search USB drives, printed records, and password vaults where the key may be stored.
- Don’t delete partitions, disable firmware security settings, or reinstall Windows until you know how that will affect the encrypted data.
Microsoft can’t bypass BitLocker without a valid recovery key. If you clear the TPM and BitLocker asks for a missing key, you may lose your encrypted files.
Wrapping Up
Fix #2, using the TPM Management Console, is my first pick. It lets you check and clear the TPM in one window. Try Windows Security next, and save PowerShell for missing graphical controls.
If the error returns, stop repeating the reset. Check the firmware, TPM hardware, company policies, and the PC for malware.
| Step | Action | Applies To |
|---|---|---|
| 1 | Back up and verify the recovery key | Every BitLocker or Device Encryption user |
| 2 | Clear through tpm.msc, Windows Security, or Clear-Tpm | Windows 11 administrators |
| 3 | Approve the restart or firmware prompt | PCs requiring physical confirmation |
| 4 | Reset the Windows Hello PIN | Users whose old PIN stops working |
| 5 | Verify TPM and BitLocker status | Every cleared PC |
