Windows 10 22H2 TPM AIK Enrollment Fails with HTTP 404 (0x80190194) – "The authority does not exist" on Intel Z890

The non-destructive path is to validate the Intel endorsement certificate and required endpoints, then escalate the rejected INTC-KeyId to Microsoft and ASUS/Intel because no documented client-side method can create a missing Microsoft AIK authority.

What the 404 establishes

GetCACaps is the SCEP capability-discovery request. In this case, the Microsoft AIK endpoint is reachable and returns a structured response saying that the specific INTC-KeyId-… authority does not exist. That is materially different from:

• a TPM command failure;
• an HTTP 400 rejection after submitting an AIK;
• an unreachable endpoint; or
• Windows component-store corruption.

A closely matching AIK case—with the same certreq -enrollaik, HTTP 404, and “authority does not exist” sequence—concluded that the authority was absent or unrecognized in the AIK service and that users cannot manually register it. That case involved Microsoft Pluton rather than Intel PTT, so it supports the interpretation of the response but does not prove the cause for this Z890 system. ^1^

Microsoft documents that Intel firmware TPMs obtain a signed endorsement certificate online and that Microsoft’s cloud CA uses the endorsement identity to validate the TPM before issuing an AIK certificate. ^2^

Collect the remaining non-destructive evidence

Run this in an elevated Windows PowerShell session:

$ek = Get-TpmEndorsementKeyInfo -HashAlgorithm Sha256

$ek | Select-Object IsPresent, PublicKeyHash,
    ManufacturerCertificates, AdditionalCertificates |
    Format-List

Get-Tpm | Format-List TpmPresent,TpmReady,TpmEnabled,
    TpmActivated,AutoProvisioning

Get-TpmEndorsementKeyInfo returns the TPM endorsement public-key hash and its manufacturer/additional certificates. ^3^

Record these outcomes without posting the complete certificate or KeyID publicly:

1. Whether IsPresent is True.
2. Whether ManufacturerCertificates contains a certificate.
3. Its issuer, validity period, and chain-validation result.
4. The complete Event 86 XML, timestamp, HTTP stage, x-ms-request-id, and redacted authority prefix.
5. The output from certreq -enrollaik -config "".

If the endorsement certificate is absent or invalid, take that evidence to ASUS or Intel. Intel firmware TPM provisioning requires access to:

• https://ekop.intel.com/ekcertservice
• https://*.microsoftaik.azure.net

These must be permitted by any DNS filter, proxy, firewall, TLS-inspection product, or security suite. ^2^

If the EK certificate is present and valid and the same authority-specific 404 remains, submit the evidence through Windows Get Help and to ASUS/Intel. Request investigation of the exact INTC-KeyId authority and include the server request ID. There is no supported local procedure documented for registering that authority.

Answers to the specific questions

• Service provisioning or local configuration?
  The response strongly points to authority lookup/provisioning or recognition at the service boundary. It does not, by itself, prove whether the missing authority originated from Microsoft’s backend inventory or from an Intel/OEM endorsement-provisioning problem. The EK checks above distinguish those paths.
• Known Z890/Windows 10 compatibility issue?
  No official Microsoft known-issue entry supplied for Windows 10 22H2 identifies the combination of Z890, Intel PTT, Event 86, and this HTTP 404. The Windows 10 release-health page does not list this AIK issue. ^4^ Reports involving Intel PTT HTTP 400 are a different failure stage and should not be treated as confirmation of this 404 problem.
• Is Windows 10 AIK enrollment still supported?
  Microsoft documentation describes AIK issuance for Windows-based devices and specifically discusses Windows 10 behavior, but Windows 10 Home and Pro 22H2 reached end of support on October 14, 2025. Microsoft states that support requests are directed toward upgrading compatible devices to Windows 11. ^5^ The available documentation does not say that the AIK endpoint was disabled for Windows 10; therefore, the 404 should not be interpreted as proof of a Windows 10-wide endpoint shutdown.
• Verified fix without Windows 11 or clearing the TPM?
  No verified client-side fix is documented for this exact Intel Z890 authority-specific 404. Do not clear the TPM merely to test it: Microsoft warns that TPM wipe/reset troubleshooting can cause data loss, and the current evidence does not identify ownership or readiness as the failure. ^6^ Clearing also cannot create an authority record in a remote service.

References

1. Windows AIK Certificate Enrollment Fails with 404 Not Found (Pluton TPM / MSFT-KeyId) - Microsoft Q&A
2. Control the health of Windows devices
3. Get-TpmEndorsementKeyInfo-Description
4. Windows 10, version 22H2 known issues and notifications
5. Windows 10 reaching end of support
6. Windows enrollment attestation