Windows Setup Error 0x8009000f 0x90002 Fix

Windows setup error 0x8009000f 0x90002 occurs when the installer cannot read or write the cryptographic keys needed to secure your system, often during a clean install or upgrade. The fix is to clear the TPM (Trusted Platform Module) or disable it temporarily in your UEFI firmware, then retry the installation. Below, we explain why this happens and walk through the most reliable solutions.

What This Error Means

The error code 0x8009000f maps to NTE_PROVIDER_DLL_FAIL, a Windows cryptographic error that means the system could not load or use a security provider. The second part, 0x90002, is an additional status code that often points to a problem with the TPM or the Secure Boot keys stored in the firmware. In practice, you will see this error during Windows Setup when it tries to create or access the BitLocker encryption keys or the virtual smart card used for Windows Hello.

This is not a hardware failure. It is a configuration conflict between the installer and the security features already present in your computer’s UEFI (the modern replacement for BIOS). The most common trigger is a TPM that is in a state the installer does not expect, such as one that has been used by a previous operating system or one that has been disabled but not fully cleared.

Why the TPM Causes Setup to Fail

The TPM is a small chip on your motherboard that stores cryptographic keys in hardware. Windows Setup uses it to protect the encryption keys for BitLocker and to verify the integrity of the boot process. If the TPM is in a “provisioned” state (already initialized with keys from a previous install), the new setup may not be able to take ownership of it, causing the error.

Another scenario involves Secure Boot. When Secure Boot is enabled, the firmware checks the signature of the boot loader. If the TPM has stale keys that do not match the new Windows installation, the check fails and setup aborts with 0x8009000f. This is more common after you have dual-booted Linux or after a failed Windows update that left the TPM in a weird state.

Finally, some motherboards have a setting called “TPM Device Selection” that can be set to either “Firmware TPM” (Intel PTT or AMD fTPM) or “Discrete TPM.” If the setting is changed between installs, the existing keys become invalid and the error appears.

How to Fix the Error

Before you try anything else, make sure you have backed up any important data. These steps will not delete your files, but they do modify firmware settings and may require a reinstall if something goes wrong.

Clear the TPM from Windows (if you can boot into your current system): Press Win+R, type tpm.msc, and press Enter. In the TPM Management window, click “Clear TPM…” in the Actions panel. You will need to restart your computer and confirm the clear in the firmware prompt. This resets the TPM to a factory state.
Clear the TPM from UEFI (if you cannot boot): Restart your computer and press the key to enter UEFI (usually Del, F2, or F10). Look for a section called “Security,” “Trusted Computing,” or “TPM.” Inside, find an option like “Clear TPM,” “Reset TPM,” or “Restore Factory Keys.” Select it, save changes, and exit. The computer will restart and may show a prompt to confirm the clear.
Disable TPM temporarily: If clearing does not work, go back to the same UEFI section and set the TPM to “Disabled.” Then try running Windows Setup again. Once the installation is complete, you can re-enable TPM and Secure Boot. Windows will automatically re-initialize the TPM.
Disable Secure Boot temporarily: In UEFI, find the “Boot” or “Security” section and set “Secure Boot” to “Disabled.” This is a separate setting from the TPM. Sometimes Secure Boot is the actual blocker, not the TPM itself. After installation, re-enable it.
If you are upgrading from an older Windows version: Run the Windows Update Troubleshooter first. Some users have reported that a pending update was interfering with the setup. The troubleshooter is in Settings > System > Troubleshoot > Other troubleshooters.

If you still see the error after trying all of the above, the issue might be with the installation media itself. Recreate the bootable USB drive using the official Media Creation Tool, and ensure you are using a USB 2.0 port (some older systems have trouble booting from USB 3.0 during setup).

What to Do If the Error Persists

If you have cleared the TPM, disabled it, and disabled Secure Boot, and the error still appears, the problem is likely not the TPM. Check the following:

BIOS version: Visit your motherboard manufacturer’s support page and check if a newer BIOS is available. Many manufacturers have released updates specifically to fix TPM-related installation bugs.
Drive format: If you are installing to a drive that was previously used with a different encryption scheme (like an Intel Optane or a hardware RAID), the setup may fail. Delete all partitions on the target drive during setup (select Custom Install, then delete each partition until you see “Unallocated Space”).
RAM issues: A faulty RAM stick can cause cryptographic operations to fail. Run a memory diagnostic (Windows Memory Diagnostic tool) to rule this out.

Preventing the Error in the Future

Once you have successfully installed Windows, you can take steps to avoid this error on your next reinstall:

Always clear the TPM before selling or repurposing a computer.
Do not switch between firmware TPM and discrete TPM modes without clearing the old keys.
Keep your UEFI firmware updated.
If you plan to dual-boot, disable Secure Boot and TPM before installing the second OS, then re-enable them after.

Frequently Asked Questions

Will clearing the TPM delete my files? No. Clearing the TPM only removes the cryptographic keys stored on the chip. Your files on the hard drive remain intact, but if you use BitLocker drive encryption, you will need your recovery key to unlock the drive after clearing the TPM.

Can I just skip the TPM requirement? Windows 11 requires TPM 2.0 and Secure Boot. If you are trying to install Windows 11, you cannot permanently skip these requirements without modifying the installation media, which is not recommended and may leave your system unsupported. For Windows 10, TPM is optional.

Why does the error appear only during a clean install, not during an upgrade? During an upgrade, Windows can reuse the existing TPM keys. A clean install attempts to create new keys, which fails if the TPM is already provisioned. Clearing the TPM before a clean install usually resolves this.

What is the difference between TPM and Secure Boot? TPM is a hardware chip that stores keys, while Secure Boot is a firmware feature that checks the signature of boot loaders. They work together but are separate settings. You can disable one without disabling the other.

Is this error dangerous? No. It is a setup failure, not a security breach. It simply means the installer cannot proceed because it cannot set up the security features. No data loss occurs unless you manually delete partitions during troubleshooting.

Will this error happen on every computer? No. It is more common on systems with a TPM that has been previously used, or on custom-built PCs where the UEFI settings are not optimized for Windows. Most pre-built computers from major brands are configured correctly out of the box.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →