After logging in, the Tailscale tray icon is always stuck on Starting and won't move no matter how long I wait.

It was finally found that the local status file could not be decrypted: the TPM did not recognize the previous key. Below is the troubleshooting process, as well as the handling methods for Windows and Linux.

Don't rush to reinstall yet

Use PowerShell to view services and processes:

Get-Service -Name Tailscale
Get-Process | Where-Object { $_.ProcessName -like '*tailscale*' }

The service is Running, and the desktop frontend is also running. There are two tailscaled.exe processes in the process list, which at first glance seems like a duplicate background startup - but it's not. One is the Windows service process, and the other has the /subproc parameter, which is a subprocess started by itself.

The Tailscale virtual network card is also present in the network configuration. Therefore, the installation and driver are not the problem, and it seems more like the frontend and backend status are not matching.

"Access denied" is a false clue

tailscale status
tailscale version

The version can be displayed normally, but checking the status prompts that it cannot access the local tailscaled.

This phenomenon is easy to mislead: a normal permission terminal may not have permission to access the local pipe used by the background service, which does not mean the service has crashed.

Switch to an administrator PowerShell and restart the service by the way:

Restart-Service -Name Tailscale
Start-Sleep -Seconds 3
tailscale status

This time the background doesn't say Starting, it directly spit out the problem:

State store failed to initialize
failed to unseal state file
failed to unseal encryption key with TPM
TPM_RC_INTEGRITY: integrity check failed
unexpected state: NoState

TPM No Longer Recognizes the Key

Tailscale's device state is stored locally, and some versions use TPM-sealed encryption keys.

Upgrading the BIOS, replacing the motherboard or TPM, migrating the system disk, or restoring a virtual machine snapshot can all cause changes to the TPM's internal state. The state file is still present, and the key appears to be as well, but the TPM no longer recognizes it. As a result, the device identity cannot be decrypted, the backend enters NoState, and the frontend remains stuck on Starting.

Windows: Back Up State Files and Re-login

Uninstalling and reinstalling may not be effective, as the corrupted state file may still be present in ProgramData. Renaming and backing up the directory is a more stable approach than deleting it entirely.

Administrator PowerShell:

Stop-Process -Name 'tailscale-ipn' -Force -ErrorAction SilentlyContinue
Stop-Service -Name Tailscale -Force

Rename-Item `
  -LiteralPath 'C:\ProgramData\Tailscale\server-state.conf' `
  -NewName 'server-state.conf.tpm-broken.bak'

Start-Service -Name Tailscale
Start-Process 'C:\Program Files\Tailscale\tailscale-ipn.exe'

Then:

tailscale status

The output will be correct like this:

Logged out.

The background has returned to a clean and initializable state, and you can log in again from the tray.

Two points to note: re-login will generate a new device identity, confirm that the new device is connected and then go to the management background to delete the old offline device; the backup file contains device status information, keep it safe first, and delete it only after confirming that it is no longer needed.

Linux: Back up first as well

The same TPM unsealing error, first stop the service and back up the status directory:

sudo systemctl stop tailscaled
sudo mv /var/lib/tailscale /var/lib/tailscale.tpm-broken.bak
sudo systemctl start tailscaled

Re-login:

sudo tailscale up

Run normally before deciding whether to clear the backup directory.

Note one sentence

This time, the most confusing thing is that three phenomena coexist: the service is Running, the virtual network card has been created, and the frontend is always Starting.

When you see this combination, don't guess the network - just run tailscale status once in the administrator terminal, and let the background speak for itself.