TPM Clear Requested: What It Means & How to Fix

If you see a message that a configuration change was requested to clear this computer’s TPM, it means the Trusted Platform Module is being reset to factory state, which erases the encryption keys it holds. This often happens after a BIOS/UEFI update, a Windows reset, or a security setting change, and you can usually approve or cancel it. Here’s what that message actually means, why it appears, and exactly what to do next.

What Is a TPM and Why Does Clearing It Matter?

The Trusted Platform Module (TPM) is a dedicated security chip on your motherboard (or integrated into the CPU) that stores cryptographic keys, passwords, and certificates in hardware. It protects data by tying encryption to the specific hardware, so a drive removed from your PC can’t be read elsewhere. Clearing the TPM removes those keys, which means anything encrypted with them—like BitLocker volumes or Windows Hello sign-in—will become inaccessible until you recover or re-establish the keys.

Clearing the TPM is not the same as wiping your hard drive. Your files remain, but if they’re encrypted with TPM-based keys (e.g., BitLocker), you’ll need the recovery key to unlock them. Without that key, the data is unrecoverable.

Why Does the “Configuration Change” Message Appear?

The exact message varies by manufacturer, but it typically appears during POST (Power-On Self-Test) when the BIOS/UEFI detects that the TPM state doesn’t match the current configuration. Common triggers:

• BIOS/UEFI update – Firmware updates often reset TPM settings.
• Windows reset or reinstall – The OS may request a TPM clear to start fresh.
• Security feature changes – Enabling or disabling Secure Boot, or changing TPM firmware version (e.g., from 1.2 to 2.0).
• Hardware changes – Replacing the motherboard or CPU can invalidate the TPM’s bindings.
• User or admin action – Someone explicitly cleared the TPM via Windows Security or BIOS.

If you didn’t initiate a clear, it could be a sign of a pending firmware update or a setting that was toggled accidentally. It’s rarely malicious, but you should verify the source before proceeding.

Should You Approve or Cancel the Clear?

If you have BitLocker enabled or use Windows Hello (PIN, fingerprint), do not approve the clear until you have your BitLocker recovery key. You can find it in your Microsoft account (if you signed in with one) or from your organization’s IT department if it’s a work device.

If you have no encryption and don’t use Windows Hello, clearing is generally safe—it will just reset the TPM and Windows will re-initialize it. However, if you’re unsure why the prompt appeared, it’s safer to cancel and investigate first.

If you’re in the middle of a Windows update or BIOS update, the clear is often expected and harmless—just make sure you have recovery keys backed up.

How to Clear the TPM (If You Choose To)

Clearing the TPM can be done from Windows or the BIOS. Here’s the standard process:

1. Back up your BitLocker recovery key – Go to Control Panel > BitLocker Drive Encryption and click “Back up your recovery key”.
2. Disable BitLocker temporarily (optional but recommended) – You can suspend protection instead of decrypting.
3. Clear via Windows Security:
   • Open Windows Security > Device security > Security processor details.
   • Click Security processor troubleshooting.
   • Under “Clear TPM”, click Clear TPM and restart.
4. Clear via BIOS/UEFI:
   • Restart and press the key to enter setup (often Del, F2, or F10).
   • Look for a security or TPM section (e.g., “Trusted Computing”, “Security Chip”).
   • Select “Clear TPM” or “Reset TPM” and confirm.

After clearing, Windows will re-initialize the TPM automatically. You may need to re-enroll Windows Hello and re-activate BitLocker (if it was on).

What Happens After the TPM Is Cleared?

Once cleared, the TPM is in a factory state. Windows will detect it and set it up again for features like:

• BitLocker – You’ll need to re-enable it and create a new recovery key.
• Windows Hello – PIN, fingerprint, and face recognition will need to be reconfigured.
• Virtualization-based security – Features like Credential Guard may re-authenticate.

If you had a TPM-based certificate (e.g., for VPN or email), you may need to re-enroll it. The process is usually seamless for most users.

Common Problems and Misconceptions

Misconception: Clearing the TPM wipes my hard drive. That’s false—your files remain, but encrypted ones become unreadable without the recovery key.

Problem: I lost my BitLocker recovery key. If you’re signed into a Microsoft account, check account.microsoft.com/devices/recoverykey. If it’s not there and you don’t have a backup, data recovery may be impossible.

Problem: The prompt appears every boot. This can happen if the BIOS is set to request a clear on each start. Enter BIOS and look for a setting like “TPM Clear” or “Clear TPM on boot” and disable it. Also check if a firmware update is pending.

Problem: Windows says TPM is not ready. After clearing, wait a few seconds and restart. If it persists, update the TPM firmware via Windows Update or the manufacturer’s site.

Frequently Asked Questions

Will clearing TPM remove my files?

No, it only erases the cryptographic keys stored in the TPM chip. Your files remain, but if they’re encrypted with BitLocker, you’ll need the recovery key to access them.

How do I find my BitLocker recovery key?

If you used a Microsoft account, go to account.microsoft.com/devices/recoverykey and sign in. If it’s a work or school device, contact your IT admin. It may also be printed or saved as a file—check your records.

Do I need to clear the TPM after a BIOS update?

Not usually. Most BIOS updates preserve TPM state. If the prompt appears, it’s often because the update reset the TPM configuration. You can safely approve if you have recovery keys, but it’s not mandatory.

Can I clear the TPM without losing Windows Hello?

No, clearing the TPM invalidates Windows Hello credentials. You’ll need to set up your PIN, fingerprint, or face again after the clear.

Is clearing the TPM dangerous?

It’s safe if you have recovery keys and understand the consequences. Without them, you risk losing access to encrypted data. Always back up keys first.

What if the prompt appears but I didn’t request it?

Check if a BIOS update is pending or if someone else with admin access cleared it. If you’re on a managed device, contact IT. If it’s a personal device and you’re concerned, cancel and run a malware scan.

Related

• Samsung S90F OLED vs LG B5 OLED: Which Budget TV Wins?
• Outlook Calendar Show End Time? How to Display It
• How AI Separates Voices in Overlapping Audio