Intel PTT TPM 2.0 – Windows AIK enrollment fails with HTTP 404 (0x80190194)

Question

Intel PTT TPM 2.0 – Windows AIK enrollment fails with HTTP 404 (0x80190194)

Giuseppe Condorelli 0

Hello, Windows AIK certificate enrollment is failing on my Intel PTT TPM 2.0 system. System: - MSI MAG Z790 TOMAHAWK WIFI - Intel Core i7-14700F - Intel PTT TPM 2.0 - BIOS: E7D91IMS.HI0 - Intel ME Firmware: 16.1.40.2765 - CPU microcode: 0x133 - Windows build: 26100 TPM EK: Manufacturer: INTC Model: ADL TPM Version: 2.0 EK Key ID: 89da7307951f06e239abd5d36b5d9697e455a4b9 The Intel EK certificate is present and the EK certificate chain has been verified. TpmDiagnostics.exe IsWindowsAIKInstalledInNCrypt returns: Windows AIK is installed. No Windows AIK Cert is installed. HR: 0x80090011 Running: certreq -enrollaik -config "" attempts to contact: https://INTC-KeyId-89da7307951f06e239abd5d36b5d9697e455a4b9.microsoftaik.azure.net/templates/Aik/scep GetCACaps fails with: HTTP/1.1 404 Not Found 0x80190194 Server response: "The authority intc-keyid-89da7307951f06e239abd5d36b5d9697e455a4b9.microsoftaik.azure.net does not exist." The failure occurs at GetCACaps before CreateRequest or SubmitRequest. The latest request ID observed was: x-ms-request-id: 773a6590-ea4d-4847-abb5-ca136604074d I have already updated BIOS and Intel ME firmware, verified TPM provisioning, verified the EK certificate and Intel certificate chain, cleared the Windows endorsement retry/cache state and retried enrollment. The HTTP 404 remains unchanged. Could you please investigate whether this Intel EK Key ID / authority is missing or not provisioned in the Microsoft AIK service? This issue also prevents Call of Duty RICOCHET Secure Attestation from completing. Thank you.

0 commenti

1 risposta

Risposta

Answer 1

This is posted in the Italian section, but since you are using English, the content below has been written in this language. If you want to use Italian instead, let me know.

Hi Giuseppe Condorelli!

You've clearly done extensive troubleshooting and already ruled out most of the common client-side causes. Based on the diagnostics you provided, I can understand why you're focusing on the AIK service itself. The test results do point to a service-side or registration issue rather than a local TPM, Windows, BIOS, or EK certificate problem.

That said, I must note that Microsoft Q&A is just a user-to-user support forum. Contributors here can share suggestions, but we do not have access to the backend AIK enrollment infrastructure. No one here can directly verify whether a specific EK Key ID is provisioned or registered in the attestation service. Here are your options:

Press Win + F and report this through Feedback Hub
Also visit Contact Us - Microsoft Support > sign in
Type in your problem > click Get Help to make request
- Scroll down and click Contact Support to connect to an agent
- Select category and continue > you should be added to a chat queue.
- If you don't see chat option, go through another category (e.g. Billings...)
Provide the EK Key ID, Request ID, as well as your troubleshooting results.

Note: The support contact team only works at certain times, so if the last window shows that it's unavailable, try opening it again the next day. If you prefer phone support, you can leave a phone number. This way, they can call you and help you.

In addition, since this involves Call of Duty, a third-party game, I would recommend contacting Activision/RICOCHET support and providing the same error details, as they may be aware of known attestation service dependencies or alternative validation methods.

If you think the answer is helpful to you, please mark this as accepted. If you have extra questions about this answer, feel free to click "Add Comment" and ask!

Note: Follow the steps in our documentation if you want to enable and receive the related email notifications for this thread.