Forum Discussion

maevynx's avatar
maevynx
Copper Contributor
Oct 26, 2026

Windows 11 Pluton TPM AIK Enrollment Fails with HTTP 404 — The authority does not exist

Hello everyone,

I'm experiencing a Windows TPM/AIK certificate enrollment issue on my ASUS TUF Gaming A14 (FA401WV), and I'm looking for guidance from someone familiar with Windows TPM attestation.

System information

  • Laptop: ASUS TUF Gaming A14 FA401WV
  • CPU: AMD Ryzen AI 9 HX 370
  • OS: Windows 11 Home Single Language, 64-bit, build 26300.9711
  • BIOS: Version 322, confirmed by ASUS as the latest available for my model
  • TPM: Microsoft Pluton TPM 2.0
  • Secure Boot: Enabled and active

Problem

Call of Duty's Secure Attestation Wizard passes the TPM 2.0 and Secure Boot checks but fails to generate the required attestation key. It reports a BIOS firmware update requirement even though my BIOS is already up to date.

To investigate the underlying issue, I ran the Windows command below from an elevated Command Prompt:

certreq -enrollaik -config ""

The request fails during GetCACaps with:

  • HTTP status: 404 Not Found
  • Windows error: 0x80190194
  • Message: "The authority does not exist."

The request is directed to a device-specific Microsoft AIK enrollment endpoint under microsoftaik.azure.net. The failure happens before certificate enrollment completes.

Troubleshooting already performed

  • Verified that Windows detects the TPM and reports it as ready.
  • Confirmed that Secure Boot is enabled and active.
  • Checked with ASUS and confirmed that BIOS version 322 is the latest available.
  • Retried AIK enrollment using my phone's mobile hotspot; the same HTTP 404 error persists.
  • Tried the game's enrollment utility, which also produced 0x80072EFD (WinHTTP cannot connect) on a separate attempt.

Another laptop using a Microsoft Pluton TPM successfully completed the same certreq -enrollaik -config "" command. I understand that this comparison does not establish the root cause, but I am including it as potentially useful context.

Questions

  1. Is this a known issue with Windows AIK certificate enrollment for Microsoft Pluton TPMs?
  2. What supported diagnostics can help determine why the device-specific AIK enrollment authority returns HTTP 404?
  3. Is there an official Microsoft support or Feedback Hub route for getting this investigated by the appropriate Windows TPM/AIK enrollment engineering team?

The laptop manufacturer confirmed that BIOS version 322 is the latest available for my device.

I can provide the full command output and diagnostic logs through an appropriate support channel. I have intentionally left out device-specific identifiers from this public post.

Thank you for any guidance.

AIK
Secure Boot
security
tpm
windows 11

2 Replies

  • maevynx's avatar
    maevynx
    Copper Contributor
    Oct 28, 2026

    Update: I found a matching report on the ASUS ROG forum.

    Another ASUS TUF Gaming A14 FA401WV owner has reported the same Call of Duty attestation failure, with BIOS 322, Microsoft Pluton TPM 2.0, and AIK enrollment failing with HTTP 404 (0x80190194) — "The authority does not exist."

    Their report is here:
    https://rog-forum.asus.com/t5/gaming-notebooks/asus-tuf-a14-fa401wv-call-of-duty-failed-attestation-pluton-tpm/td-p/1167965

    This provides another example of the same symptoms on the same laptop model. Could someone familiar with Windows TPM/AIK enrollment help determine whether the device-specific AIK authority is correctly provisioned, and advise on the appropriate technical escalation route?

    I understand that the matching symptoms do not yet prove a common root cause. Any guidance from the Windows security or TPM engineering community would be appreciated.

  • The-Architect's avatar
    The-Architect
    Copper Contributor
    Oct 27, 2026

    I'm experiencing the exact same issue on my ASUS TUF Gaming A14 equipped with the AMD Ryzen AI 9 HX 370 and Microsoft Pluton TPM.

    Call of Duty's Secure Attestation Wizard fails at the TPM attestation stage, despite TPM 2.0 and Secure Boot being enabled and correctly detected by Windows.

    I also reproduced the exact same HTTP 404 error when running:

    certreq -enrollaik -config ""

    The enrollment request fails with:

    • HTTP status: 404 Not Found
    • Windows error: 0x80190194
    • Message: "The authority does not exist."

    This strongly suggests that we're encountering the same underlying AIK enrollment issue.

    My system information:

    • Laptop: ASUS TUF Gaming A14
    • CPU: AMD Ryzen AI 9 HX 370
    • BIOS: Version 322 (latest available)
    • TPM: Microsoft Pluton (Pluton.TPM.A)
    • TPM firmware: 10.5.0.1
    • TPM 2.0: Present and ready
    • Endorsement Key (EK): Present
    • Manufacturer certificates: 1

    I've already tried resetting the TPM and performing multiple troubleshooting steps without success.

    Another major issue is that I'm currently running BIOS version 322 and cannot downgrade to version 319. This leaves me stuck on the latest BIOS with no apparent workaround.

    Given that two users with identical hardware are reproducing the same AIK enrollment failure, this appears to be a potentially broader compatibility or provisioning issue involving Microsoft Pluton, the device firmware, or Microsoft's AIK enrollment infrastructure.

    Could someone from Microsoft's Windows Security / TPM / Pluton engineering team investigate this issue?

    We would particularly appreciate clarification on:

    1. Why the Microsoft AIK enrollment endpoint returns HTTP 404 for our devices.
    2. Whether BIOS 322 or the current Pluton firmware could be involved.
    3. Whether Microsoft and ASUS are aware of this issue and if a fix is being developed.
    4. What official diagnostic or escalation process we should follow.

    At this point, we're unable to resolve the issue through standard troubleshooting or BIOS rollback.

    I'm happy to provide additional logs and diagnostic information to help investigate.

    Thank you!