Subject: Call of Duty Attestation Wizard – AIK Certificate Enrollment Failure on Intel PTT

Hello,

I am unable to complete the Call of Duty Attestation Wizard. It reports:

“New key failed to be generated. BIOS firmware update recommended.”

I have already verified that Secure Boot and TPM 2.0 are enabled and working correctly. I have also updated my Intel Management Engine driver, but the problem persists.

My system specifications:

• PC: Thermaltake Gaming Desktop NE i1460TGS-V170S

Motherboard: ASRock B760M-C

BIOS: American Megatrends 12.01, dated June 18, 2026

TPM: Intel PTT, specification version 2.0

TPM firmware: 600.18.1040.2765

Windows: Windows 11 64-bit

Secure Boot: Enabled

BIOS Mode: UEFI

Troubleshooting already completed:

Verified TPM is present, enabled, activated, ready, and capable of attestation.

Confirmed Windows reports the device health status as Attestable.

Confirmed Windows pre-attestation checks pass, including TPM responsiveness, endorsement key certificate availability, and PCR measurements.

Installed the Windows TPM Diagnostics capability and ran the diagnostic commands.

Ran TPMDiagnostics.exe InstallEkCertThroughCoreProv and certutil -pulse, then restarted.

Updated the Intel Management Engine driver using the ASRock driver package version 2541.8.41.0_CONS.

Verified that the Windows AIK certificate is still missing using TPMDiagnostics.exe GetWindowsAIKCert. It returns 0x80090011.

Attempted certreq -EnrollAIK, which fails with 0x80070490 (Element not found).

Windows TPM-WMI Event 1041 reports that the device is Attestable, but the Windows AIK certificate availability checks are all false.

The TPM endorsement key certificate is detected, but Windows cannot obtain or install its AIK certificate. The Call of Duty Attestation Wizard therefore cannot generate its required key.

Could you investigate the Windows AIK certificate enrollment failure and confirm whether this is a known Intel PTT, firmware, or attestation-service compatibility issue? Please provide a supported fix or escalation path. I would prefer not to clear the TPM, reinstall Windows, or change Secure Boot keys without confirmation that doing so is necessary.

Thank you.Hello,

I am unable to complete the Call of Duty Attestation Wizard. It reports:

“New key failed to be generated. BIOS firmware update recommended.”

I have already verified that Secure Boot and TPM 2.0 are enabled and working correctly. I have also updated my Intel Management Engine driver, but the problem persists.

My system specifications:

PC: Thermaltake Gaming Desktop NE i1460TGS-V170S

Motherboard: ASRock B760M-C

BIOS: American Megatrends 12.01, dated June 18, 2026

TPM: Intel PTT, specification version 2.0

TPM firmware: 600.18.1040.2765

Windows: Windows 11 64-bit

Secure Boot: Enabled

BIOS Mode: UEFI

Troubleshooting already completed:

Verified TPM is present, enabled, activated, ready, and capable of attestation.

Confirmed Windows reports the device health status as Attestable.

Confirmed Windows pre-attestation checks pass, including TPM responsiveness, endorsement key certificate availability, and PCR measurements.

Installed the Windows TPM Diagnostics capability and ran the diagnostic commands.

Ran TPMDiagnostics.exe InstallEkCertThroughCoreProv and certutil -pulse, then restarted.

Updated the Intel Management Engine driver using the ASRock driver package version 2541.8.41.0_CONS.

Verified that the Windows AIK certificate is still missing using TPMDiagnostics.exe GetWindowsAIKCert. It returns 0x80090011.

Attempted certreq -EnrollAIK, which fails with 0x80070490 (Element not found).

Windows TPM-WMI Event 1041 reports that the device is Attestable, but the Windows AIK certificate availability checks are all false.

The TPM endorsement key certificate is detected, but Windows cannot obtain or install its AIK certificate. The Call of Duty Attestation Wizard therefore cannot generate its required key.

Could you investigate the Windows AIK certificate enrollment failure and confirm whether this is a known Intel PTT, firmware, or attestation-service compatibility issue? Please provide a supported fix or escalation path. I would prefer not to clear the TPM, reinstall Windows, or change Secure Boot keys without confirmation that doing so is necessary.

Thank you.