# Feedback Hub Submission Template

## Title
Windows AIK Certificate Enrollment Fails with HTTP 404 — AMD Pluton TPM KeyId Not Registered in Azure AIK Service

## Category
Security & Privacy > TPM / Device Security

## Description

### Issue Summary

Windows AIK certificate enrollment fails with HTTP 404 because the AMD Pluton TPM's EK KeyId is not registered in Microsoft's Azure AIK enrollment service (microsoftaik.azure.net). This blocks all TPM-based hardware attestation, including Call of Duty RICOCHET anti-cheat, Windows Device Health Attestation, and enterprise MDM scenarios.

### Environment

| Item | Value |
|------|-------|
| Device | ASUS ROG Strix G16 (G614FR) |
| CPU | AMD Ryzen (Microsoft Pluton security processor) |
| OS | Windows 11 Pro, Build 26200 |
| BIOS | G614FR.317 (2026-07-02, latest from ASUS) |
| TPM | AMD Pluton, Manufacturer ID: MSFT, Firmware: 6.4.1.400, Spec 2.0 |
| Secure Boot | Enabled |
| Boot Mode | UEFI |

### Key Identifiers

| Item | Value |
|------|-------|
| TPM KeyId | `MSFT-KeyId-144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2` |
| Azure Authority | `msft-keyid-144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2.microsoftaik.azure.net` |
| EK Issuer | `CN=Pluton Factory DEVICE EK ICA DFID00A60F11` |
| Root CA | `CN=Microsoft Pluton Root CA 2021, O=Microsoft Corporation, C=US` |
| Enrollment URL | `https://msft-keyid-144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2.microsoftaik.azure.net/templates/Aik/scep` |
| Error Code | `0x80190194` (HTTP_E_STATUS_NOT_FOUND) |

### Error Details

When running `certreq -enrollaik -machine -config ""`, the Azure AIK service responds:

```json
HTTP/1.1 404 Not Found
{"Message":"The authority \"msft-keyid-144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2.microsoftaik.azure.net\" does not exist."}
```

### Local TPM Status (All Healthy)

- TPM 2.0: Present, Ready, Enabled, Activated
- EK Certificate: Present in TPM NV storage, installed to Windows registry
- EK Certificate Chain: Valid (5-element chain, trust error reduced to 0x8 — revocation check warning only)
- AIK Key: Installed and persistent in TPM (Persistent: True, Matching: True)
- AIK Certificate: **MISSING** — enrollment fails due to Azure 404
- Secure Boot: Enabled
- UEFI Boot Mode: Confirmed
- GPT Boot Partition: Confirmed

### Troubleshooting Already Performed

1. Installed EK certificate from TPM NV storage via `TpmDiagnostics.exe InstallEkCertFromNVR` — Success
2. Installed EK certificate through Core Provider via `TpmDiagnostics.exe InstallEkCertThroughCoreProv` — Success
3. Downloaded and installed AMD Pluton root certificate chain (Pluton Factory DEVICE EK ICA, Microsoft Pluton Policy CA A, Microsoft Pluton Root CA 2021) into Windows Trusted Root store — Success
4. Downloaded and installed AMD CRL from `https://ftpm.amd.com/hsp/crl/00A60F11-device.crl` — Success
5. Cleared TPM and re-provisioned via `TpmDiagnostics.exe ProvisionTpm force clear` — Success
6. Uninstalled and reinstalled Windows AIK key via `TpmDiagnostics.exe InstallWindowsAIK` — Key installed successfully, but cert enrollment fails
7. Ran `TpmDiagnostics.exe EnrollWindowsAIKCert` — Fails with 0x80090011 (no AIK cert)
8. Ran `certreq -enrollaik -machine -config ""` — Fails with 0x80190194 (HTTP 404)

None of the above resolved the issue. The error is consistently HTTP 404 from Azure, indicating the Pluton KeyId is not registered server-side.

### Impact

- **Call of Duty (RICOCHET Anti-Cheat)**: Locked out of multiplayer, only campaign mode available. Game displays "Failed Attestation Status — BIOS Firmware Update Required" (false positive — BIOS is already latest version).
- **Windows Device Health Attestation**: Cannot complete attestation.
- **Enterprise MDM/Attestation Scenarios**: Blocked.

### Related Reports

This is a known systemic issue affecting multiple TPM platforms:
1. Microsoft Q&A: "Windows AIK Certificate Enrollment Fails with 404 Not Found (Pluton TPM)" — https://learn.microsoft.com/en-au/answers/questions/5985657/
2. Microsoft Q&A: "Azure AIK enrollment returns HTTP 404 (Intel Arrow Lake-S)" — https://learn.microsoft.com/en-au/answers/questions/5982629/
3. Microsoft Q&A: "Pluton TPM attestation fails for Call of Duty RICOCHET" — https://learn.microsoft.com/en-us/answers/questions/5961831/

### Request

Please escalate this to the **Windows Kernel Security / Azure Attestation Engineering Team** to onboard the AMD Pluton TPM KeyId (`MSFT-KeyId-144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2`) into the microsoftaik.azure.net global AIK trust pool. This would resolve AIK enrollment for all AMD Pluton users affected by this issue.

### Attachments Available Upon Request

- TPM EK Certificate (exportable via `TpmDiagnostics.exe GetEkCertFromNVR`)
- Full certreq diagnostic output
- TpmDiagnostics ekchain/ekchainNV output
- Full system information (msinfo32)