Windows 11 TPM AIK Enrollment Fails – HTTP 400 / 0x80190190 – Intel PTT

Question

Windows 11 TPM AIK Enrollment Fails – HTTP 400 / 0x80190190 – Intel PTT

Bryan Manning 0

I’m experiencing a Windows TPM/AIK attestation failure despite TPM 2.0 and Secure Boot both functioning normally.

System:

ASRock B860 Pro-A WiFi
Intel Core Ultra 7 265F
Windows 11 Home
BIOS 3.32 / UEFI
Intel PTT / TPM 2.0
TPM firmware: 700.19.1011.2289
Secure Boot: Enabled

Windows reports the TPM as present, ready, enabled, activated, owned, and capable of attestation. TPM diagnostics also report:

Ready For Attestation: True Is Capable For Attestation: True Clear Needed To Recover: False TPM Has Vulnerable Firmware: False

However, Windows measured-boot/attestation diagnostics report:

HealthStatus: Cannot be attested EkCertIsAvailable: false

The TPM Endorsement Key certificate is present and matches the TPM public key. The EK certificate issuer is:

CN=ODCA 2 CSME MTP PCH SVN 01 PTT CA

Windows AIK objects are present but do not have certificates associated with them.

The Windows scheduled task:

\Microsoft\Windows\CertificateServicesClient\AikCertEnrollTask

fails with:

0x80190190 (HTTP 400 Bad Request)

This is also preventing Call of Duty Secure Attestation from completing. Its diagnostic tool reports:

TPM 2.0: PASS Secure Boot: PASS Attestation Requisite: NOT MET

Attempting to generate a new attestation key results in:

New Key Failed to be generated – BIOS Firmware Update Recommended

I have already updated to the latest available motherboard BIOS and worked with the motherboard manufacturer to clear and reinstall the default Secure Boot keys. The required Microsoft 2023 Secure Boot certificates are present and Secure Boot remains active.

The issue began after the motherboard was replaced while the existing Windows installation/SSD was retained.

My main question: Does 0x80190190 combined with EkCertIsAvailable=false indicate that Windows/Microsoft's AIK enrollment service is unable to validate the Intel PTT EK certificate chain?

I have seen other recent reports involving the ODCA 2 CSME MTP PCH SVN 01 PTT CA issuer and similar HTTP 400 AIK enrollment failures.

I would prefer not to clear the TPM, reinstall Windows, or manually modify the Windows certificate stores unless one of those actions is confirmed to be appropriate for this specific condition.

Any guidance on additional Windows TPM/AIK diagnostics or whether this Intel PTT certificate chain is currently supported would be appreciated.

麒麟白 0 Reputation points

2026-09-11T08:30:06+00:00

Same issue here — this is confirmed to be a server-side Azure

Attestation trust pool problem, not a local misconfiguration.

Microsoft Q&A moderators have confirmed there is currently no local

workaround. The only lever we have is to get this in front of the

Azure Attestation / Pluton engineering team.

If you are affected, please upvote this Feedback Hub report so it

gets prioritised:

https://aka.ms/AA13eibd

(Category: Security and Privacy > TPM)

1 answer

Your answer

麒麟白 0 Reputation points

2026-09-11T08:30:06+00:00

Same issue here — this is confirmed to be a server-side Azure

Attestation trust pool problem, not a local misconfiguration.

Microsoft Q&A moderators have confirmed there is currently no local

workaround. The only lever we have is to get this in front of the

Azure Attestation / Pluton engineering team.

If you are affected, please upvote this Feedback Hub report so it

gets prioritised:

https://aka.ms/AA13eibd

(Category: Security and Privacy > TPM)

Answer 1

Hi Bryan Manning,

Based on the details you provided, it appears that the TPM and Secure Boot components are functioning correctly, as both TPM 2.0 and Secure Boot pass validation and the TPM reports that it is capable of attestation. However, the attestation process itself is not completing because AIK certificate enrollment is failing with error 0x80190190 (HTTP 400), and Windows reports EkCertIsAvailable = false during attestation checks. This suggests the issue may be occurring during the AIK enrollment or certificate validation stage rather than with the TPM hardware configuration itself.

Since you have already updated the BIOS, restored Secure Boot keys, and confirmed TPM health, you may want to try the following targeted checks:

1, Run the AIK enrollment task manually

Open Task Scheduler.
Navigate to Microsoft > Windows > CertificateServicesClient.
Run AikCertEnrollTask and review any new Event Viewer entries.

2, Verify Windows is fully updated

Go to Settings > Windows Update.
Install all available updates, including optional platform and security updates.

3, Refresh TPM attestation status

Open an elevated Command Prompt.
Run: dsregcmd /status
Review the TPM and device health sections for additional attestation-related errors.

If the issue started after the motherboard replacement, allow Windows time to re-establish attestation identity after updates and several restarts before considering more invasive actions.

If the AIK enrollment task continues to return HTTP 400 errors after the above checks, collecting the corresponding Event Viewer logs from Applications and Services Logs > Microsoft > Windows > CertificateServicesClient may help identify whether the enrollment request is being rejected due to attestation data, certificate validation, or platform identity changes following the motherboard replacement.

Let me know if you need further assistance, feel free to ask me by clicking "Add Comment" or "Add Answer" if you cannot add comment so your response will be visible. Thanks for your effort.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.