Azure AIK enrollment fails with 0x80190190: “No valid TPM EK/Platform certificate provided” on Intel CSME ADL PTT

Question

Azure AIK enrollment fails with 0x80190190: “No valid TPM EK/Platform certificate provided” on Intel CSME ADL PTT

Christopher Siriska 5

I am unable to launch Call of Duty because the Secure Attestation check reports “BIOS firmware: Update Required,” but the system firmware and TPM appear to be compliant.

System summary:

Motherboard: ASUS TUF GAMING Z790-PLUS WIFI
BIOS: 1836
Intel ME / TPM firmware reported by Windows: 600.18.1040.2765
BIOS Mode: UEFI
Secure Boot State: On
TPM Present: True
TPM Version: 2.0
TPM Ready: True
Ready For Attestation: True
Is Capable For Attestation: True
TPM Has Vulnerable Firmware: False

The actual failure appears to be Microsoft AIK enrollment, not the BIOS. Running:

certreq -enrollaik -config ""

returns:

HTTP/1.1 400 Bad Request 0x80190190 / HTTP_E_STATUS_BAD_REQUEST “No valid TPM EK/Platform certificate provided in the TPM identity request message.”

The Call of Duty broker log also repeatedly shows:

Enroll AIK result -2145844848

I have already updated the BIOS to the latest available ASUS version and confirmed the Intel ME/PTT firmware update applied. Windows reports the TPM is ready and capable for attestation, but Azure AIK enrollment rejects the TPM EK/platform certificate chain.

Please advise whether this is a Microsoft Azure AIK trust-chain issue for Intel CSME ADL PTT, and whether there is a supported client-side fix. If this cannot be resolved, I need this escalated or refunded because the game is blocked despite the system meeting the published TPM 2.0 and Secure Boot requirements.

Christopher Siriska 5 Reputation points

2026-08-27T01:42:15.13+00:00
UPDATE — Aug 26/27, 2026: AIK behavior has changed, now failing with HTTP 404 at GetCACaps

I reran the AIK diagnostics after repairing the Windows component store with DISM (/RestoreHealth completed successfully) and confirming sfc /scannow reports no integrity violations.

I also checked both TPM EK certificate-chain paths:

TpmDiagnostics.exe ekchainNV Trust dwErrorStatus: 0x0 cElement: 7 TpmDiagnostics.exe ekchain Trust dwErrorStatus: 0x0 cElement: 7

Both successfully build the same 7-element Intel EK chain, so I am no longer seeing evidence of an incomplete local Windows EK certificate chain.

I then reran AIK enrollment:

cmd.exe /c 'certreq -enrollaik -config ""'

The result is now different from my original June failure.

Current result:

TPM-Version:2.0 VendorID:'INTC' Firmware:39321618.68160205 INTC-KeyId-886696551a320484cc7abb6fcb30520d708cdb4a CN=www.intel.com, OU=OnDie CA Root Cert Signing, O=Intel Corporation, L=Santa Clara, S=CA, C=US Directory Address: TPMVersion=id:02580012 TPMModel=ADL TPMManufacturer=id:494E5443 (INTC) https://INTC-KeyId-886696551a320484cc7abb6fcb30520d708cdb4a.microsoftaik.azure.net/templates/Aik/scep GetCACaps GetCACaps: Not Found {"Message":"The authority \"intc-keyid-886696551a320484cc7abb6fcb30520d708cdb4a.microsoftaik.azure.net\" does not exist."} HTTP/1.1 404 Not Found Date: Thu, 27 Aug 2026 01:37:47 GMT x-ms-request-id: 9a752fb7-cfc7-424a-972c-cb52db7c6ee2 EnrollStage = 140 GetCACert = 0ms GetCACaps = 203ms CreateRequest = 0ms SubmitRequest = 0ms Certificate Request Processor: Not found (404). 0x80190194 HTTP_E_STATUS_NOT_FOUND

This is materially different from the original June result.

Previously, enrollment used:

INTC-KeyId-ea950d987bcff0df9aac1feffb8ab4803fef2ca2 OU=ODCA 2 CSME P_ADL 00002983 Issuing CA

and reached SubmitRequest, where Microsoft AIK returned:

HTTP 400 0x80190190 "No valid TPM EK/Platform certificate provided in the TPM identity request message."

The current attempt does not reach request creation or EK validation at all. It fails during GetCACaps because the Microsoft AIK service reports that the derived INTC-KeyId-886696... authority does not exist.

At this point:

TPM 2.0 PASS TPM ready PASS Attestation capable PASS Secure Boot PASS ekchainNV PASS (0x0) ekchain PASS (0x0) DISM component repair PASS SFC CLEAN AIK enrollment FAIL Microsoft AIK GetCACaps HTTP 404

Could this please be escalated to the Microsoft AIK / attestation infrastructure team?

Specifically, can Microsoft confirm:

Whether authority INTC-KeyId-886696551a320484cc7abb6fcb30520d708cdb4a is expected to exist in the Microsoft AIK service.

Why the Intel EK chain now resolves to this authority instead of the previous INTC-KeyId-ea950d... authority.

Whether this Intel OnDie/CSME ADL authority is missing or incorrectly provisioned in the Microsoft AIK infrastructure.

Whether there is any supported client-side action remaining when both ekchainNV and ekchain validate successfully with dwErrorStatus: 0x0.

The 404 occurs before a certificate request is created, so clearing the TPM or repeatedly reinstalling Windows does not appear relevant to this specific failure stage.

4 answers

Your answer

Answer 1

Bradley selph 0

I had the same issue and tried everything mentioned here, including every troubleshooting step short of reinstalling Windows on a new drive. Nothing worked.

The solution that finally fixed it was removing all drives from the system, clearing the TPM in the BIOS, and performing a clean installation of Windows on a different drive. After installing all Windows updates, reinstalling the drivers, and going through several restarts, I was finally able to install the game, pass the attestation checks, and play without issues.

Based on my experience, the only reliable fix at the moment is a clean Windows installation. Unfortunately, none of the other methods worked.

Christopher Siriska 5 Reputation points

2026-07-04T04:36:37.9233333+00:00

That is crazy to have to do that. I am not going through that just to play COD and you shouldn't have had to either. That's nuts. Microsoft needs to address this asap.

Answer 2

豐川祥子 0

Maybe you can try:

https://www.xiaoheihe.cn/app/bbs/link/afe571fca832?h_camp=link&h_src=YXBwX3NoYXJl

It's a Chinese tutorial so translation is needed.

0 comments

Answer 3

豐川祥子 0

I'm encountering this problem too. 400 means your TPM EK certs chain is corrupted. You can use "tpmdiagnostics.exe ekchain"(Go Settings>Apps > Options features and install this) to check if your Windows EK chain is fine. You can extract certs from TPM hardware or download some from Intel to fix the chain. After that maybe it's solved. Why maybe? Because the return will possibly change to 404 Not Found.

0 comments

Answer 4

Rayyan Fawad 1,075

The 0x80190109 / 0x80190190 Azure AIK enrollment failure on Intel CSME platforms happens because Microsoft's cloud attestation endpoints are failing to validate the Endorsement Key (EK) certificate chain provided by your built-in Intel PTT firmware. Even though Windows reports the TPM is ready, Call of Duty's anti-cheat engine requires a fully verified hardware trust chain, which breaks if the local certificate issued by Intel is either missing from Microsoft’s cloud lookup directory or corrupted in the firmware layer.

To clear this on the client side, you need to force Windows to completely clear and re-provision the TPM identity:

Clear the TPM completely: Open Windows Security, navigate to Device Security > Security Processor Details > Security Processor Troubleshooting, and select Clear TPM. Your PC will restart; make sure you have any Windows BitLocker recovery keys backed up before doing this.

Force Certificate Re-Enrollment via PowerShell: After the reboot, open PowerShell as an Administrator and execute the command Enroll-TpmAeCsr (or run certreq -enrollaik -config "" in an elevated prompt) to force Windows to request a fresh, clean attestation identity key token directly from the Microsoft cloud endpoints.

Verify Intel ME Driver State: If the cloud still rejects the certificate chain, the issue stems from an outdated Intel Management Engine Interface component. Navigate to your ASUS TUF Z790-PLUS motherboard support page, explicitly download and install the standalone Intel ME Consumer Driver Package (do not rely on standard Windows Update versions), and re-run the attestation check.

Christopher Siriska 5 Reputation points

2026-06-05T13:10:56.8266667+00:00
I am not unfamiliar with computers. I know how to troubleshoot. Here is the more technical breakdown. I have already troubleshooted, grabbed logs, resetting TPM keys is just getting to the same error with extra steps and a headache.

=== BIOS ===

SMBIOSBIOSVersion ReleaseDate

1836 2026-04-15 8:00:00 PM

=== TPM ===

-TPM Present: True

-TPM Version: 2.0

-TPM Manufacturer ID: INTC

-TPM Manufacturer Full Name: Intel

-TPM Manufacturer Version: 600.18.1040.2765

-PPI Version: 1.3

-Is Initialized: True

-Ready For Storage: True

-Ready For Attestation: True

-Is Capable For Attestation: True

-Clear Needed To Recover: False

-Clear Possible: True

-TPM Has Vulnerable Firmware: False

-Bitlocker PCR7 Binding State: Binding Not Possible

-Maintenance Task Complete: True

-TPM Spec Version: 1.38

-TPM Errata Date: Wednesday, December 18, 2019

-PC Client Version: 1.04

-Lockout Information:

-Is Locked Out: False -Lockout Counter: 0 -Max Auth Fail: 32 -Lockout Interval: 7200s -Lockout Recovery: 86400s

=== EK CERT ===

Subject Issuer Thumbprint

TPMVersion=id:02580012, TPMModel=ADL, TPMManufacturer=id:494E5443 CN=CSME ADL PTT 01SVN D3CA7D4D52B63FD19DAD1C94FD0...

=== AIK ENROLLMENT FAILURE ===

v2.0

TPM-Version:2.0 -Level:0-Revision:1.38-VendorID:'INTC'-Firmware:39321618.68160205

INTC-KeyId-ea950d987bcff0df9aac1feffb8ab4803fef2ca2

CN=www.intel.com, OU=ODCA 2 CSME P_ADL 00002983 Issuing CA

Directory Address: TPMVersion=id:02580012 TPMModel=ADL TPMManufacturer=id:494E5443 (INTC)

https://INTC-KeyId-ea950d987bcff0df9aac1feffb8ab4803fef2ca2.microsoftaik.azure.net/templates/Aik/scep

x-ms-client-request-id = a444406b-9146-4696-b6e1-e3d35c7143bb

SHA256

AES128

SubmitDone

Submit(Request): Bad Request

{"Message":"No valid TPM EK/Platform certificate provided in the TPM identity request message."}

HTTP/1.1 400 Bad Request

Date: Fri, 05 Jun 2026 06:09:29 GMT

Content-Length: 96

Content-Type: application/json; charset=utf-8

X-Content-Type-Options: nosniff

Strict-Transport-Security: max-age=31536000;includeSubDomains

x-ms-request-id: ae33137b-b175-4c1d-b658-c557bc493bc0

EnrollStage = 220

GetCACert = 125ms

GetCACaps = 187ms

CreateRequest = 2172ms

SubmitRequest = 203ms

ProcessResponse1 = 0ms

SubmitChallengeAnswer = 0ms

ProcessResponse2 = 0ms

Enroll = 2375ms

Total = 7954ms

Certificate Request Processor: Bad request (400). 0x80190190 (-2145844848 HTTP_E_STATUS_BAD_REQUEST)

=== COD BROKER LOG ===

[3640] 06/05/26 01:57:19: Enroll AIK result -2145844848.
Rayyan Fawad 1,075 Reputation points

2026-06-05T13:14:00.33+00:00

You've nailed the exact root cause here. That 400 Bad Request from the microsoftaik endpoint means your hardware is functioning perfectly, but Microsoft’s cloud validation server is outright rejecting the endorsement certificate path for this specific Intel firmware build (OU=ODCA 2 CSME P_ADL). Since clearing the TPM won't fix an untrusted cloud-side intermediate root chain, your best bet to bypass this loop right now is to stop the system from indefinitely chasing hardware attestation. Open an elevated Command Prompt and run certutil -DeleteRegisteredTemplates to wipe the dirty caching state. If this is blocking a corporate Entra ID or Intune enrollment, you can force the OS to fall back to a software token by going to HKLM\SOFTWARE\Microsoft\Enrollments in the registry, creating a DWORD named RegContinuousAttestationRetry, and setting it to 0. This will break the hang until Microsoft syncs the Intel ODCA 2 root certificate down to their cloud infrastructure!
Christopher Siriska 5 Reputation points

2026-06-05T13:23:20.3733333+00:00

That isn't going to solve my problem, and could potentially make things worse in my case. My problem is Call of Duty is failing when the Attestation check runs, and hits that failure. If I try to bypass, or anything similar, I risk getting my account banned. I just want them to stop lying to people about the problem. I am reasonably good with computers, to anyone who isn't this is hell trapped in a box.
Rayyan Fawad 1,075 Reputation points

2026-06-05T13:29:15.5566667+00:00

You are completely right to call that out, and I apologize—if you are dealing with an aggressive anti-cheat system like Ricochet for Call of Duty, registry bypasses or tricking the OS are absolutely off the table and a fast track to a permanent account ban. Because the game engine runs its own strict, low-level hardware verification checks, it will instantly flag a machine whose local OS is reporting an attestation bypass while the underlying cloud log is actively recording an untrusted 400 Bad Request.

Since we can't safely touch the software side without putting your gaming account at risk, the only clean way out is to address the hardware firmware directly. If this loop started after a recent motherboard update, your vendor bundled an Intel Management Engine (CSME) build with a newer root signature that Microsoft's Azure endpoints simply haven't whitelisted yet. Your best, zero-risk move is to check your OEM's driver page for a standalone "Intel ME Consumer Firmware Component" patch to cleanly re-provision the internal PTT Endorsement Key, or roll back your BIOS to the immediate previous stable revision to restore a globally recognized certificate chain.
Christopher Siriska 5 Reputation points

2026-06-05T13:36:35.74+00:00

Appreciate your help my friend. Hopefully Microsoft sees this and takes a peak at the problem.
Christopher Siriska 5 Reputation points

2026-06-07T14:45:29.5333333+00:00

I appreciate your reply, I have gone through all those steps and more. It is actually kind of frustrating. Same thing every time 400 bad request.