How to Fix “The Trusted Platform Module (TPM) Hardware Failed to Execute a TPM Command” Error in Windows 11

In Windows 11 systems, the Trusted Platform Module (TPM) is an essential component that enables advanced security features, such as BitLocker encryption, Windows Hello authentication, Secure Boot, and Credential Guard. However, some users may occasionally encounter this error – “The Trusted Platform Module (TPM) hardware failed to execute a TPM command” which can disrupt these essential security functions.

To help IT administrators and power users restore full TPM functionality, we’ll discuss various approaches to diagnosing and resolving TPM command execution failures using native Windows tools, including TPM.MSC, PowerShell, Device Manager, and BIOS/UEFI settings.

Troubleshooting “The Trusted Platform Module (TPM) hardware failed to execute a TPM command” error

When Windows 11 reports a “TPM failed” error, it often signals a critical failure in how the OS communicates with the TPM chip. You might encounter this issue under several conditions:

• BitLocker fails to resume or initialize after startup or updates
• Windows Hello shows errors or fails during sign-in
• System logs record TPM failures with Event ID 1794 or Event ID 14 under  the following location (though this location may vary by OEM/driver):

Event Viewer > Applications and Services Logs > Microsoft > Windows > Tpm > Operational

This TPM execution error may stem from

• firmware-level conflicts,
• corrupted TPM keys,
• an outdated BIOS, or
• misconfigured TPM drivers.

The methods below should help you diagnose the cause of the issue, repair it, and restore full TPM functionality on Windows 11 systems.

Note: Check out the key prerequisites before proceeding to avoid issues while troubleshooting.

Method 1: Check TPM status via TPM.MSC

This first method is a nonintrusive status check that confirms whether the TPM is present, ready, and responsive.

Note: Local administrator rights are required.

1. Open the TPM management console. Press Win + R, type “tpm.msc,” and press Enter.
2. Review the Status section and look for the following messages:
   • “The TPM is ready for use.” This means it’s functioning normally
   • “TPM is not available.” or “TPM has malfunctioned.” This indicates deeper issues

If TPM issues are detected, clear the TPM (use Method 2 to use the GUI or Method 3 to use PowerShell).

Alternatively, check TPM status via Windows Security

1. Open Settings > Privacy & Security > Windows Security.
2. Select Device security.
3. Click Security processor details.
4. Review the status under Security processor.

If the security processor is unavailable or shows errors, proceed with TPM reset steps.

Method 2: Clear and reset the TPM via the TPM management console

The GUI method resets the TPM to factory defaults, clearing stored keys and invalid configurations that may be causing command execution failures.

Note: Suspend BitLocker and backup recovery keys. Local administrator rights are required.

1. Open the TPM management console. Press Windows key + R, type “tpm.msc,” and press Enter.
2. Under Actions, select Clear TPM.
3. Follow the on-screen prompts and reboot when requested.

If TPM is still broken, try a BIOS update (Method 4).

Method 3: Clear and reset the TPM via PowerShell

PowerShell enables you to query and reset the TPM to factory defaults programmatically. This method is helpful for scripting, for remote troubleshooting, or when GUI tools are unavailable.

Note: Suspend BitLocker and backup recovery keys. Local administrator rights are required.

1. Open an elevated PowerShell. Press Win + R, type “powershell,” and press Ctrl + Shift + Enter.
2. Copy and paste the following command before hitting Enter:
   • Get-CimInstance -Namespace "Root\CIMv2\Security\MicrosoftTpm" -ClassName Win32_Tpm
   • Note: Get-CimInstance replaces the deprecated Get-WmiObject cmdlet in modern PowerShell versions. Get-WmiObject may still run in some environments, but it is prone to “Access Denied” or “Command Not Found” errors.
   • This command will check if the TPM is present, enabled, activated, and ready. If you see errors or no output, proceed to step 3.
3. Copy and paste the following command before hitting Enter:
   • Clear-Tpm
   • This command resets the TPM to factory settings.
4. Confirm the action and reboot the system when requested.

If the TPM is still broken, try a BIOS update (Method 4).

Method 4: Update BIOS/UEFI firmware

This method will update your system firmware, which controls how the TPM is initialized at boot. This can resolve incompatibility or misconfiguration issues, especially when the TPM isn’t detected or continues to show hardware malfunction messages.

⚠️Updating your system’s BIOS firmware is a high-risk process. Interruptions or errors can cause permanent damage, or data loss, or make your system unusable. Proceed with extreme caution.

Note: Suspend BitLocker and back up the recovery keys.

1. Download and install the latest BIOS/UEFI from your OEM’s website.
2. Reboot your system and enter the BIOS by pressing the correct key (usually Del, F2, or Esc).
3. Ensure TPM, Intel PTT, or AMD fTPM is enabled under security settings.

If the TPM is still broken, reinstall the TPM driver (Method 5).

Method 5: Reinstall the TPM driver in Device Manager

This method removes and reinstalls the TPM device driver, resolving driver-level conflicts or corruption after Windows Updates or device migrations. It’s best used when the TPM fails despite appearing “Ready” in TPM.MSC or when you have errors related to the driver in Device Manager or Event Viewer.

Note: Local administrator rights are required.

1. Open Device Manager. Press Win + X and select Device Manager.
2. Expand Security Devices.
3. Right-click Trusted Platform Module 2.0 and choose Uninstall device.
4. Reboot your system. Windows will automatically scan for hardware changes and reinstall the TPM.

Key prerequisites before proceeding

Before attempting the methods outlined above, it’s essential to meet specific preconditions to help prevent data loss, system instability, and encryption lockouts.

• Ensure the system has a TPM (physical or firmware-based; v2.0 is required for Windows 11). Open TPM.MSC, which should open the TPM management console and confirm its presence.
• Sign in with administrator privileges because modifying TPM settings, accessing BIOS, or uninstalling device drivers all require elevated privileges.
• Suspend BitLocker before making TPM changes to avoid triggering BitLocker recovery or making the encrypted drive inaccessible. Run this command on PowerShell (replace X with the letter of the target drive):

manage-bde -protectors -disable X:

• Backup all critical data and encryption keys before making changes to avoid permanently losing access to encrypted data.

Why resolve TPM command execution errors?

The TPM enables many security mechanisms that modern enterprises and security-conscious users rely on. When the TPM cannot execute commands as expected, it disrupts essential functions and exposes the system to operational and compliance risks. Addressing TPM command execution errors should help:

Ensure compatibility with core Windows security features

Many Windows security services use TPM, including:

• BitLocker, which relies on TPM to securely store encryption keys and to unlock the system during boot
• Windows Hello, which uses TPM to store biometric credentials in a secure, hardware-protected enclave
• Credential Guard and Virtualization-Based Security, which depends on TPM for secure key storage and attestation

These features may not work correctly if TPM fails to execute commands, leading to degraded security or system failure.

Restore TPM functionality after firmware or OS changes

TPM-related errors may occur after BIOS/UEFI firmware updates and OS upgrades as these updates can reset TPM states, corrupt keys, or disable TPM entirely in firmware settings. Resolving these errors ensures the TPM remains functional and re-integrated with system-level security features.

Prevent service disruptions and access failures

Failing TPM communication can lead to the following:

• BitLocker unexpectedly entering recovery mode
• The inability to sign in using Windows Hello or a PIN
• The interruption of secure VPN, RDP, or certificate-based authentication
• Compliance check failures during enterprise enrollment or device health attestation

Resolving this issue should help avoid lost productivity, helpdesk escalations, or user lockouts.

Maintain compliance with security policies

Many organizations require TPM 2.0 for compliance with Microsoft’s Windows 11 hardware baseline, endpoint protection frameworks, and regulatory compliance with standards that mandate device encryption and secure credential storage. A malfunctioning TPM can result in audits, security violations, or failure to meet internal and external regulatory standards.

Additional considerations after fixing TPM command execution errors

After successfully resetting or reconfiguring the TPM, it’s essential to ensure that the system is securely restored to a compliant and functional state. Consider the following points to prevent future TPM-related disruptions and maintain endpoint security integrity.

BitLocker recovery

Resetting or clearing the TPM erases the keys that BitLocker uses to unlock the drive. To avoid recovery key prompts, always suspend BitLocker before making TPM changes, then re-enable it afterward.

Event Viewer logs

Even if the TPM appears functional, Event Viewer may still log residual issues. Regular log reviews can help catch early signs of recurring problems. Look for TPM error logs with Event ID 14 (command failure) and Event ID 1794 (initialization errors).

Device health attestation

TPM failures can affect compliance with MDM or Intune enrollment. If your computer doesn’t pass the health check, it might:

• lose access to Outlook, Teams, or shared drives
• trigger a message saying your device is “out of compliance,” or
• require IT support to fix TPM, encryption, or boot settings

Secure Boot

Secure Boot ensures that only trusted firmware and OS loaders can execute during boot. Some TPM reset operations may inadvertently disable Secure Boot in the firmware, so it should be re-enabled after firmware or TPM changes.

Hardware end-of-life/warranty or TPM chip failure

In the event that you aren’t able to remedy the TPM error or reset the module, the only fix may be to replace the motherboard or TPM chip as the firmware/hardware itself may be corrupted or may have reached its end-of-life.

Key takeaways when troubleshooting TPM command execution errors

Resolving the TPM command execution error in Windows 11 is essential for

• maintaining secure boot processes,
• protecting sensitive data with BitLocker, and
• ensuring compliance with enterprise security policies.

By clearing the TPM, updating BIOS, or resetting related drivers, users can address specific root causes, from key corruption to firmware misconfigurations.

Overall, a healthy and responsive TPM is critical for both personal device security and enterprise IT governance, so follow each method carefully, verify system integrity afterward, and take preventive measures to ensure long-term stability and security.