Intel PTT TPM 2.0 – AIK Attestation Enrollment Fails with HTTP 404

Escalate the Intel ODCA/Key ID to Microsoft Support for an AIK-service authority lookup, because users cannot register or repair a missing microsoftaik.azure.net authority locally.

Your exact Intel PTT/ADL symptom has been reported: SCEP fails during GetCACaps with HTTP 404 / 0x80190194 and “The authority does not exist.” This means the Microsoft endpoint was reached, but it did not recognize that authority hostname; only the service owner can determine whether the Intel authority is absent, disabled, or incorrectly mapped.^1^

Open the support case

1. Open Get Help from Windows Settings, search for AIK GetCACaps HTTP 404, and choose Contact Support if the suggested solutions do not resolve it.^2^
2. Select Windows as the product.
3. Ask for escalation to the team responsible for Windows TPM attestation / Microsoft Cloud CA / AIK SCEP.
4. Request this specific backend check:

   Is this Intel PTT ODCA/Key ID registered and mapped to an active INTC authority in the Microsoft AIK SCEP service?

Microsoft documents that the AIK certificate is issued by its cloud service after it establishes that the device has a genuine TPM and possesses the presented AIK.^3^

Include this evidence

Provide the following privately in the support case:

• Exact authority hostname, with the unique identifier included.
• TPM manufacturer/model: Intel INTC / ADL PTT.
• EK issuer: CSME ADL PTT 01SVN.
• Failed stage: GetCACaps.
• Response: HTTP 404 / 0x80190194 / “The authority does not exist.”
• The x-ms-request-id and UTC timestamp from the Event Viewer or command output, if available.
• Windows edition, build, motherboard/OEM model, BIOS version, and Intel ME firmware version.
• Full redacted output from the enrollment attempt.
• Confirmation that TPM is ready, Secure Boot is enabled, and the manufacturer EK certificate is present.

Do not post the complete EK certificate, hardware serial numbers, or unredacted diagnostics publicly.

What the result establishes

Because the failure happens at GetCACaps, it occurs before the AIK certificate request is submitted. Your existing checks already establish the normal local prerequisites, so repeating TPM initialization, Secure Boot checks, or EK installation is not indicated.

A closely comparable AIK case with the same 404 response concluded that TPM Key IDs and AIK authorities cannot be manually registered by users and that there is no supported client-side method to modify the service trust database.^4^

The public evidence therefore supports a probable service-side authority-provisioning or mapping problem, but it does not expose the backend registration records needed to confirm the current support status of your particular Intel authority. Microsoft Support must perform that lookup.

Avoid destructive TPM remediation

Do not clear the TPM, modify TPM NV indexes, or repeatedly regenerate keys for this 404. Those actions cannot create a cloud authority and can disrupt TPM-protected credentials or encryption. Microsoft warns that TPM troubleshooting involving wipe/reset can cause data loss and requires backups.^5^

If Microsoft later fixes or confirms the authority and GetCACaps succeeds, retry enrollment. A subsequent error at Submit would be a separate problem requiring analysis of that new status rather than further treatment of this 404.

References

1. Windows AIK enrollment fails with HTTP 404 for Intel PTT EK authority
2. [Windows 11](https://support.microsoft.com/accessibility/windows/use-a-screen-reader-to-navigate-windows-support-tools#open-get-help-from-settings-app)
3. Control the health of Windows devices
4. Windows AIK Certificate Enrollment Fails with 404 Not Found (Pluton TPM / MSFT-KeyId) - Microsoft Q&A
5. Windows enrollment attestation