Windows AIK Certificate Enrollment Fails with 404 Not Found (Pluton TPM / MSFT-KeyId)

Question

Windows AIK Certificate Enrollment Fails with 404 Not Found (Pluton TPM / MSFT-KeyId)

Shion W 20

System Information

text

OS Name:                   Microsoft Windows 11 家庭版 中文版

Issue Description

When attempting to enroll a Windows AIK certificate using the command certreq -enrollaik -config "", the request returns an HTTP 404 Not Found error.

The Microsoft Azure AIK service responds with:

text

{"Message":"The authority \"msft-keyid-144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2.microsoftaik.azure.net\" does not exist."}

This indicates that the KeyID for my Pluton TPM is not registered in the Microsoft Azure AIK backend service.

Error Details

text

KeyID:          MSFT-KeyId-144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2

Full Error Log

text

v2.0

Troubleshooting Steps Already Performed

The following diagnostic and repair steps have been completed, none of which resolved the issue:

Deployed TpmDiagnostics:

text

DISM /Online /Add-Capability /CapabilityName:Tpm.TpmDiagnostics~~~~0.0.1.0

Installed EK certificate from TPM NV:

text

TpmDiagnostics.exe InstallEkCertFromNVR

Result: Successfully installed cert in registry

Retrieved EK certificate through Core Provisioning:

text

TpmDiagnostics.exe InstallEkCertThroughCoreProv

Result: Successfully retrieved EK Certificate

Verified local certificate chain:

text

TpmDiagnostics.exe ekchainNV

Result: Local certificate chain is valid and consistent (Trust dwErrorStatus: 0x10000)

Attempted AIK enrollment using TpmDiagnostics:

text

TpmDiagnostics.exe EnrollWindowsAIKCert

Result: 0x80090011 (NTE_BAD_KEYSET)

Attempted AIK enrollment using certreq:

text

certreq -enrollaik -config ""

Result: 0x80190194 (HTTP 404 Not Found) - The authority does not exist

Checked AIK installation status:

text

TpmDiagnostics.exe IsWindowsAIKInstalledInNCrypt

Result: No Windows AIK Cert is installed

Diagnostic Conclusion

Component****StatusLocal TPMHealthy (TpmPresent: True, TpmReady: True, TpmEnabled: True)Local TPMHealthy (TpmPresent: True, TpmReady: True, TpmEnabled: True)Local EK Certificate ChainValid (dwErrorStatus: 0x10000)Azure AIK Service EndpointResponding with 404****Root Cause: The Microsoft Azure AIK service does not have a record for this Pluton TPM's KeyID (MSFT-KeyId-144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2). The certificate enrollment request fails at the server side, not due to any local configuration issue.

Impact

This issue prevents applications that rely on TPM-based hardware attestation from functioning correctly. In my specific case:

Call of Duty (COD) multiplayer mode is restricted to "Campaign only" due to failed attestation

The game displays: "Failed Attestation Status BIOS Firmware Update Required"

This is a false positive as BIOS is already up to date and all TPM requirements are met

Request

I respectfully request the following:

Escalate this issue to the Windows Kernel Security / Azure Attestation Engineering Team for investigation.

Register the Pluton TPM KeyID (MSFT-KeyId-144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2) in the Microsoft Azure AIK backend service.

Alternatively, provide guidance on any additional steps I can take to resolve this issue on my end.

Key Identifiers Summary

ItemValueTPM KeyIDMSFT-KeyId-144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2TPM KeyIDMSFT-KeyId-144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2Azure Authoritymsft-keyid-144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2.microsoftaik.azure.netTPM VendorMSFT (Microsoft Pluton)EK IssuerCN=Pluton Factory DEVICE EK ICA DFID00A60F11Error Code0x80190194 (HTTP 404 Not Found)Serial NumberT4NRKD004302154BIOS VersionG614FR.316---

Attachments Available Upon Request

TPM EK Certificate (can be exported via TpmDiagnostics.exe GetEkCertFromNVR)

Additional diagnostic logs

Screenshots of error messages

Contact Information

text

Name: SHION

Shion W 20 Reputation points

2026-08-26T04:06:45.42+00:00

This issue is NOT related to Azure Backup or any Azure product. I was forced to select this tag due to the mandatory tagging requirement. This is a Windows TPM (Microsoft Pluton) AIK certificate enrollment issue. Please escalate this to the Windows Kernel Security / Azure Attestation Engineering Team.

Answer accepted by question author

0 additional answers

Your answer

Shion W 20 Reputation points

2026-08-26T04:06:45.42+00:00

This issue is NOT related to Azure Backup or any Azure product. I was forced to select this tag due to the mandatory tagging requirement. This is a Windows TPM (Microsoft Pluton) AIK certificate enrollment issue. Please escalate this to the Windows Kernel Security / Azure Attestation Engineering Team.

Answer 1

Welcome to Microsoft Q&A!

Thank you for taking the time to provide such detailed diagnostics and troubleshooting results. I understand how frustrating this issue must be, especially after thoroughly validating the TPM, EK certificate chain, BIOS, and Windows configuration, only to continue encountering AIK enrollment failures.

Based on the information you've shared, this does not appear to be a local TPM, BIOS, Windows configuration, or EK certificate installation issue. Your diagnostics consistently indicate that the device is correctly configured and capable of attestation:

TPM is present, enabled, ready, and capable of attestation.
The EK certificate chain validates successfully locally (dwErrorStatus: 0x10000).
EK certificate retrieval from both TPM NVR and Core Provisioning succeeds.
AIK enrollment fails when communicating with the Microsoft AIK enrollment service.

The key failure reported is:

HTTP 404 Not Found

"The authority 'msft-keyid-144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2.microsoftaik.azure.net' does not exist."

This error occurs before an AIK certificate can be issued and generally indicates that the corresponding TPM KeyID or endorsement certificate chain is not recognized by the backend AIK enrollment service. Similar reports have been observed from other users experiencing AIK enrollment failures where the service returned "authority does not exist" responses for specific TPM KeyIDs.

From the evidence provided:

"certreq -enrollaik -config" returns 0x80190194 (HTTP 404 Not Found).
The AIK endpoint responds with "authority does not exist"
No Windows AIK certificate is currently installed.
Local TPM health and endorsement certificate validation checks pass successfully.

Taken together, these findings strongly suggest a service-side attestation or AIK enrollment issue rather than a client-side configuration problem.

Unfortunately, TPM KeyIDs and AIK service authorities cannot be manually registered by end users, and there is no supported method to modify the Microsoft AIK trust database. If the backend service does not contain a valid authority entry for the TPM's endorsement hierarchy, there is currently no known client-side workaround.

I would like to share the following recommended steps.

1.Submit the issue through Feedback Hub and include:

TPM diagnostic logs
EK certificate chain
certreq -enrollaik output
Screenshots of the error

2.Contact ASUS Support and provide:

TPM KeyID
EK certificate chain
BIOS version
Full AIK enrollment logs

3.Open a Microsoft Support case, as further investigation may require involvement from the engineering team responsible for TPM attestation and AIK enrollment services.

4.Include the failing authority information in any escalation:

msft-keyid-144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2.microsoftaik.azure.net

As well as the associated Microsoft Pluton EK issuer details and diagnostic results.

At this time, the available evidence points toward a backend AIK registration or trust-onboarding issue that would require investigation by the team responsible for the Microsoft AIK attestation service, rather than additional troubleshooting on the device itself.

Note: Microsoft Q&A is a public community forum and does not provide a direct path to Engineering escalation. For issues involving AIK service authority registration or attestation backend infrastructure, Feedback Hub submissions and Microsoft Support requests are the appropriate escalation channels.

I hope this helps clarify the situation.

If you found this answer helpful, please consider clicking Accept Answer.

Thank you for using Microsoft Q&A.

Shion W 20 Reputation points

2026-08-31T11:33:29.1033333+00:00

Thank you for the confirmation. I understand that this is a service-side issue and cannot be resolved locally. Could you please advise on the best way to get this escalated to the engineering team? I have already submitted via Feedback Hub. Are there any additional steps I should take to ensure this reaches the Windows Security / Azure Attestation team?
Daphne Huynh (WICLOUD CORPORATION) 1,225 Reputation points Microsoft External Staff Moderator

2026-09-04T06:56:31.8433333+00:00

Thank you for the update, and I appreciate that you've already submitted feedback through Feedback Hub.

Unfortunately, Microsoft Q&A is a public community forum and we do not have a mechanism to directly escalate issues to the Windows Security, TPM, Pluton, or Azure Attestation engineering teams. Engineering teams review issues through Microsoft's internal support and feedback channels rather than through Q&A posts.

Since you have already submitted Feedback Hub feedback, the recommended additional steps are:

1.Open a Microsoft Support case and provide:

Your TPM KeyID

EK certificate information

AIK enrollment logs

The failing authority name

Feedback Hub submission details (if available)

2.Contact your device manufacturer (ASUS) and share the TPM EK certificate chain, BIOS version, and attestation-related diagnostics. OEMs can sometimes coordinate with Microsoft when TPM provisioning or attestation onboarding issues are identified on specific hardware platforms.

3.Continue monitoring Feedback Hub for requests from Microsoft engineers for additional logs or diagnostics.

Based on the diagnostics you provided, the issue appears to occur during communication with the Microsoft AIK enrollment service rather than during local TPM initialization or EK certificate validation. Because the authority endpoint returns "The authority does not exist," further investigation would likely require access to backend service telemetry that is not available to community moderators or end users.

I understand this may not be the answer you were hoping for, but at this point Microsoft Support and Feedback Hub are the appropriate channels for obtaining engineering review of the issue.