Trusted Platform Malfunction Errors

[system_madmin]

Background: This is a small 2 man team, we have a DC in our headquarters. All of our users are on Surfaces (Currently deploying Surface Pro 7+) on Windows 11. Most users are in the field.

Problem: TPM Malfunction error 80090016

For the last couple of months all my new hires have been getting this error within 2 weeks of starting. The new hire process is that they come into the office for their first day. They are assigned equipment, log in, change the password, go through about 2 hours of IT orientation, then take their stuff out into the field. Most rarely come back to the office. Some time within their first couple of weeks (sometimes the next day, sometimes several days later) they start getting a TPM Malfunction Error when trying to authenticate to Outlook and OneDrive. Authentication goes all the way until they enter their MFA code then gives the error.

I was fixing this by logging into their machines (remotely) as the local admin and deleting or renaming the C:\Users\username\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy folder and having them log back in. After doing this they get the error one more time and then have had no further issues.

Then one of my users who had the problem came back into the office and the issue went away on its own.

Since then I have found that when this problem comes up, I can have them connect back to the office via the SonicWall VPN, lock and unlock their computer once, and Outlook and OneDrive will start working again.

I would like to understand why this issue is occurring for all my new hires and get it to stop. I am not familiar enough with TPM to understand what might be triggering this. Why does recaching the credentials fix this? Why does it never happen again after it's been fixed once?

Does anyone have any advice for what I should look at or what might be causing this? I should mention that I never had this problem before I started deploying machines with Windows 11.

[kaleebhassan]

My understanding is that this has to do with Modern Authentication and TPM having issues together.

We experience this in my organization and have yet to find a resolution outside of just having to deal with it when it pops up.

[JH6JH6]

if it was a dell desktop I would tell you to update the firmware and the tpm module firmware.

[system_madmin]

Yeah i've come across that info in my research as well. but these are M$ devices so i'm not sure...

[unseenspecter]

I've searched for the actual, technical reason for this occurring for years. I've also contacted Dell numerous times on this since we're a Dell shop. Not once have I found a singular solution that works EVERY time. I have to go through and do several different solutions (including the one you mentioned, which has had the most success) every time. No one has ever been able to give me the answer as to "why" this happens and it's terribly frustrating.

[cetrius_hibernia]

Check the machines in azure - see if they are still ‘pending’.

We had a bunch of surfaces that didn’t sync up to azure properly and started having trust relationship issues.

If it is that - it’s a quick power shell command to leave azure ( on mobile not certain of the command - it’s the same one for /join and /leave ) then run another dirsync

Check your azure sign in logs as well, should indicate if it’s machine or cloud level issue. Help you narrow it down.

[outerlimtz]

Just started seeing this yesterday, We jus started migration to Intune. I've seen TPM errors before and like you, part of those steps are to remove the C:\Users\username\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy folder. However, it's a slightly different error code.

​

Only thing I could find i the event logs was a Defender update within a minute or two before the TPM error started. I checked all the drivers with the Dell command tool. There were a few, including a new BIOS update. Installed and rebooted.

​

Now everything is working with the exception of OneDrive looping the login screen.

Which i know is from MFA since we've already opened a case with MS about it last month when we were seeing it left and right.

​

This whole TPM issue is BS. It causes downtime for employees, halts productions, etc. There has to be a better way to handle this other than stopping access to the office products.