How to clear the TPM in Windows 11 and 10 (and what you lose)

What clearing the TPM does and what you lose

The TPM (Trusted Platform Module) is the security chip, or firmware TPM in the processor, that holds keys for BitLocker, Windows Hello and other features. Microsoft explains that clearing it resets it to an unowned state, and Windows then automatically reinitializes it and takes ownership again.

Microsoft suggests clearing it as a troubleshooting step or as the last step before a clean install of a new operating system. It also notes that, even without clearing, most TPM functions will probably work, so clearing isn’t a routine fix. What goes with it:

• All keys created in the TPM and anything protected by them, such as a virtual smart card or a sign-in PIN. Microsoft warns that clearing the TPM can result in data loss.
• Windows Hello: Microsoft says a PIN or biometric sign-in will no longer work afterwards. You sign in with your password and set it up again.
• BitLocker: clearing the TPM is one of the events Microsoft lists as a trigger for BitLocker recovery, so an encrypted drive can ask for its recovery key at the next start.

If you only want to pause the TPM, Microsoft points out that on Windows 11 you can turn it off temporarily instead of clearing it.

Before you clear the TPM

1. Check the PC is yours to reset. Microsoft’s guidance is not to clear the TPM on a work or school PC unless your IT administrator tells you to.
2. Back up your files and anything else that is encrypted or protected by the TPM.
3. Save the BitLocker recovery key. It’s a 48-digit number. For a personal PC it’s usually in your Microsoft account at account.microsoft.com/devices/recoverykey. Our BitLocker recovery key guide lists the other places it can be.
4. Suspend BitLocker on the system drive. Open PowerShell as administrator (right-click Start, then Terminal (Admin) on Windows 11 or Windows PowerShell (Admin) on Windows 10) and run the command below. A RebootCount of 0 keeps it suspended until you resume it, and the drive stays fully encrypted the whole time.

Suspend-BitLocker -MountPoint "C:" -RebootCount 0

Suspending is enough; you don’t need to turn BitLocker off and decrypt the drive. See BitLocker suspended for what that state means. Microsoft also recommends checking your PC maker’s documentation first, and you need to be signed in as an administrator.

Clear the TPM in Windows Security

This is the method Microsoft documents, and its advice is to always clear the TPM from Windows rather than directly from the UEFI firmware settings.

1. Open Windows Security from the Start menu. (Microsoft’s page still calls it the Windows Defender Security Center.)
2. Select Device security, then Security processor details.
3. Select Security processor troubleshooting.
4. Under Clear TPM, select Clear TPM and confirm the restart.
5. During the restart, the PC may show a firmware screen asking you to press a key to confirm the clear. Press it; if you skip it, the clear is normally cancelled.

That confirmation screen is a physical-presence check: the firmware wants someone at the keyboard to approve wiping the chip. The key it asks for varies by PC maker, so read the prompt. Microsoft says the TPM is prepared for use by Windows automatically once the PC restarts.

You can also start the clear from the TPM Management console: press Win + R, type tpm.msc and use the Clear TPM option in the Actions pane on the right (the exact wording varies a little between Windows versions). It leads to the same restart and confirmation.

Clear the TPM with PowerShell

In an administrator PowerShell window:

Clear-Tpm

Microsoft describes Clear-Tpm as resetting the TPM to its default state, removing the owner authorization value and any keys stored in it. Without parameters it uses the owner authorization value Windows keeps in the registry. If that fails, ask the firmware to do the clear at the next restart instead:

Clear-Tpm -UsePPI

Then restart. As with the Windows Security method, Microsoft notes that the restart might need you to approve the clear at the keyboard.

After the restart: check it and set things up again

Once Windows is back, run Get-Tpm in an administrator PowerShell window. TpmPresent should be True, and TpmReady becomes True once Windows has finished preparing the TPM again. If it still says False, restart once more and check again.

1. Sign in with your password and set up your Windows Hello PIN again in Settings > Accounts > Sign-in options. If Windows shows a PIN error instead, see your PIN is no longer available.
2. Resume BitLocker if you suspended it:

Resume-BitLocker -MountPoint "C:"

3. Check your Secure Boot state too if you were troubleshooting Windows 11 security requirements.

If BitLocker asks for a recovery key

If you didn’t suspend BitLocker first, the PC may stop at a blue BitLocker recovery screen. Type the 48-digit recovery key you saved, or look it up from another device in your Microsoft account. Windows starts normally after that. If a firmware prompt about the TPM appeared after a hardware change rather than a clear, see the fTPM/PSP NV corrupted guide.

Related guides

• BitLocker suspended: what it means and how to resume protection
• Dell BitLocker recovery key: where to find it and why it appears
• Secure Boot state: how to check it and what On, Off and Unsupported mean
• New CPU Installed: fTPM/PSP NV Corrupted – Should You Press Y or N?

Official sources:

• Microsoft Learn: Initialize and configure ownership of the TPM
• Microsoft Support: Update your security processor (TPM) firmware
• Microsoft Learn: Clear-Tpm