Fix Windows Upgrade Error 0x80090011

Windows upgrade error 0x80090011 typically appears when the system cannot read or write to the secure boot or TPM (Trusted Platform Module) keys during an update or clean installation. The fix usually involves clearing the TPM, disabling secure boot temporarily, or repairing the Windows Update components. Below are the most reliable steps to resolve it, followed by background on why it happens and how to prevent it.

What Causes Error 0x80090011?

Error 0x80090011 is a Windows Update and installation error that occurs when the operating system cannot access or modify the cryptographic keys stored in the TPM or the secure boot UEFI firmware. This can happen for several reasons:

• Corrupted TPM driver or firmware – The TPM chip may have outdated or corrupted firmware, preventing Windows from reading the keys.
• Secure Boot misconfiguration – If Secure Boot is disabled or set to the wrong mode (e.g., “Custom” instead of “Standard”), Windows may fail to verify the upgrade files.
• Pending TPM ownership – If the TPM is already owned by another OS or has leftover keys, Windows cannot take ownership.
• Windows Update component corruption – Damaged update files or services can trigger this error during the upgrade process.
• BIOS/UEFI settings after a hardware change – Replacing a motherboard or SSD can leave the TPM in an inconsistent state.

Step-by-Step Fixes

Try these in order. Most users resolve the error with the first two steps. If not, continue down the list.

1. Clear the TPM from Windows

1. Press Windows + R, type tpm.msc, and press Enter.
2. In the TPM Management window, click “Clear TPM…” on the right panel. (You may need administrator rights.)
3. Restart your PC. Windows will reinitialize the TPM automatically.

Note: Clearing the TPM will remove all keys created by Windows, including those used for BitLocker encryption. Make sure you have your BitLocker recovery key before proceeding.

2. Disable Secure Boot Temporarily

1. Restart your PC and enter the UEFI/BIOS setup (usually by pressing F2, F10, Del, or Esc during boot).
2. Find the Secure Boot option – typically under Boot or Security.
3. Set it to Disabled.
4. Save and exit. Try the Windows upgrade again.
5. After the upgrade, re-enable Secure Boot and set it to Standard mode.

If you cannot find Secure Boot, consult your motherboard manual or the manufacturer’s support site. Some systems label it as “Secure Boot Control” or “Windows 8/10 WHQL Support.”

3. Run Windows Update Troubleshooter

1. Open Settings > Update & Security > Troubleshoot.
2. Select Windows Update and click Run the troubleshooter.
3. Follow the on-screen instructions. This will reset Windows Update components and clear cache.

4. Reset Windows Update Components Manually

If the troubleshooter doesn’t help, stop the Windows Update services and delete the update cache:

1. Open Command Prompt as administrator (right-click Start > Command Prompt (Admin)).
2. Run these commands one by one:

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old
net start wuauserv
net start cryptSvc
net start bits
net start msiserver

Then restart your PC and try the upgrade again.

5. Update BIOS/UEFI Firmware

An outdated BIOS can cause TPM and Secure Boot issues. Check your motherboard manufacturer’s website for a BIOS update. Follow their instructions carefully – a failed BIOS update can render your PC unbootable.

6. Perform a Clean Installation (Last Resort)

If nothing else works, back up your files and do a clean installation of Windows using the Media Creation Tool. This will erase everything on your system drive, so ensure you have backups.

How to Avoid This Error in the Future

• Keep your BIOS/UEFI firmware updated.
• Do not disable Secure Boot unless absolutely necessary; if you do, re-enable it after the upgrade.
• Regularly check for Windows updates and install them promptly.
• If you use BitLocker, keep a copy of your recovery key in a safe place.

Common Mistakes and Misconceptions

Many users mistakenly think this error is caused by a virus or a failing hard drive. In reality, it’s almost always a TPM or Secure Boot issue. Another common misconception is that you need to reinstall Windows to fix it – usually you don’t. Also, some people disable Secure Boot and forget to re-enable it, which can cause other problems like unable to run certain games or apps that require Secure Boot (e.g., Windows 11).

Another mistake is clearing the TPM without backing up BitLocker keys. This can lock you out of your encrypted drive permanently. Always decrypt your drive or have the recovery key before clearing the TPM.

Frequently Asked Questions

Will clearing the TPM erase my files?

No, clearing the TPM does not delete your personal files. It only removes cryptographic keys used for encryption. If you use BitLocker, you will need the recovery key to access your drive after clearing the TPM.

Can I fix this error without going into BIOS?

Yes, you can try the Windows-based fixes first – running the troubleshooter, resetting Windows Update components, or clearing the TPM via tpm.msc. If those don’t work, you will need to enter BIOS to disable Secure Boot or update firmware.

Is it safe to disable Secure Boot?

Disabling Secure Boot is safe temporarily, but it reduces the security of your system by allowing unsigned code to run during boot. Re-enable it as soon as the upgrade is complete. Some newer games and anti-cheat software require Secure Boot to be enabled, so leaving it off can cause problems.

Does this error affect Windows 11 upgrades?

Yes, error 0x80090011 can occur during Windows 11 upgrades, especially if your PC has TPM 2.0 and Secure Boot enabled but the firmware is misconfigured. The same fixes apply.

What if the error persists after all steps?

If you’ve tried all the steps and the error still appears, there may be a hardware issue with the TPM chip itself. Contact your PC or motherboard manufacturer for support. In rare cases, replacing the motherboard is the only solution.

Related

• Fix Virtual Machine Terminated Unexpectedly Exit Code 1
• Fix Background Intelligent Transfer Service (BITS) in Windows 10
• Ways to Lock Windows 10 Computer: 7 Methods