I am experiencing a TPM AIK enrollment failure on Windows 11 with an Intel Core Ultra 7 265F and Intel PTT 2.0.
TPM 2.0 is enabled, ready and functional. Secure Boot is enabled and active. Windows TPM diagnostics reports the machine as attestable.
I identified and repaired an incomplete local Intel EK certificate chain using the Intel intermediate certificates stored in my own TPM NV storage. After repair:
TpmDiagnostics.exe ekchain
now reports:
Trust dwErrorStatus: 0x10000
However, AIK enrollment still fails when running:
certreq -enrollaik -config ""
Microsoft now returns:
HTTP 404 Not Found
0x80190194 / HTTP_E_STATUS_NOT_FOUND
Server response:
The authority "intc-keyid-<PII removed>.microsoftaik.azure.net" does not exist.
Intel PTT KeyId:
TPM Manufacturer: Intel (INTC) TPM Model: MTP CPU: Intel Core Ultra 7 265F Motherboard: ASRock B860M-C BIOS: 3.31 Windows 11 Home 64-bit, build 26200.9168
The failure occurs during GetCACaps, before an AIK enrollment request is submitted.
Microsoft request ID:
<PII removed>
This is affecting Call of Duty Secure Attestation because Windows cannot obtain a Windows AIK certificate despite the TPM EK certificate chain now validating successfully.
Please escalate this to the team responsible for Microsoft AIK/Azure TPM attestation infrastructure. Can you confirm whether this Intel PTT KeyId/authority needs to be provisioned or onboarded in the Microsoft AIK service?